Broccoli question

Development
1

Hi,

Can somebody tell me if BRO_TYPE_TABLE is supported at part of a record? More specifically, I want to send records that look something like this to Bro using Broccoli.

  type example_record: record
  {
        uid: string;
        hash: table [string] of string;
  };

However, my implementation core dumps when the following is called (after populating hashTable with key/value pairs):

  BroTable *hashTable = bro_table_new();
  .
  .
  .
   bro_record_add_val(rec, "hash", BRO_TYPE_TABLE, NULL, hashTable);
  .
  .
  bro_event_add_val(ev, BRO_TYPE_RECORD, NULL, rec);

I could not find any examples in the docs or test library on how to include a table as a field in a record.

Thanks,

Randy

2

Regardless of whether it’s part of a record, I don’t think broccoli can create and send tables (as well as sets/vectors). You may have to send individual key-value pairs and reconstruct the table on the Bro-side.

- Jon

3

Ok, that's the path that I'll take. Thanks for confirming.
  
-- Randy