# Error when parsing conn.log field name into table with input framework

**URL:** <https://community.zeek.org/t/error-when-parsing-conn-log-field-name-into-table-with-input-framework/7086>\
**Category:** Zeek\
**Created:** [July 10, 2023, 7:43pm UTC](https://community.zeek.org/t/error-when-parsing-conn-log-field-name-into-table-with-input-framework/7086 "2023-07-10T19:43:57Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![bjeffries](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/bjeffries/32/687_2.png) [@bjeffries](https://community.zeek.org/u/bjeffries)\
**Post date:** [July 10, 2023, 7:43pm UTC](https://community.zeek.org/t/error-when-parsing-conn-log-field-name-into-table-with-input-framework/7086/1 "2023-07-10T19:43:57Z")

</div>

I am attempting to read conn.log data into a zeek table.

I am following the example on zeek docs here: [Input Framework — Book of Zeek (git/master)](https://docs.zeek.org/en/master/frameworks/input.html)

I am having issues with setting the table index to the following conn.log fields: id.orig\_h, id.resp\_h

The example from zeek docs:

> type Idx: record {  
>   ip: addr;  
> };

My modified code is:

> type Idx: record {  
>   id.orig\_h: addr;  
>   id.resp\_h: addr;  
> };

I get the following error:

 ![image](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/9daf5a76987d2f7784c5fdd8ab53a0209b73d810.png)

The input reader maps the Idx variables to the field names in the log file. If a period (.) is an invalid character for zeek script variable names, is there an escape character or substitution I need to use?

---

<div class="post-metadata">

**Author:** ![bjeffries](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/bjeffries/32/687_2.png) [@bjeffries](https://community.zeek.org/u/bjeffries)\
**Post date:** [July 10, 2023, 8:16pm UTC](https://community.zeek.org/t/error-when-parsing-conn-log-field-name-into-table-with-input-framework/7086/2 "2023-07-10T20:16:41Z")

</div>

I have confirmed that the error is indeed resulting from an illegal field declaration as a period is not a valid character. But that still does not solve my problem, as I don’t see a way to reference that log data with the input framework outside of the field name.

[5.2.1. Identifiers — Spicy v1.9.0-dev.37 (zeek.org)](https://docs.zeek.org/projects/spicy/en/latest/programming/language/identifiers.html)

---

<div class="post-metadata">

**Author:** ![awelzel](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/awelzel/32/609_2.png) [@awelzel](https://community.zeek.org/u/awelzel)\
**Post date:** [July 11, 2023, 12:02pm UTC](https://community.zeek.org/t/error-when-parsing-conn-log-field-name-into-table-with-input-framework/7086/3 "2023-07-11T12:02:28Z")

</div>

Hey @bjeffries - you can solve parsing the `.` separated fields by using nested types in `Idx`.

```auto
# Read a conn.log into conn_table indexed by orig_h and resp_h.

@load base/protocols/conn
redef exit_only_after_terminate=T;

type my_conn_id: record {
        orig_h: addr;
        resp_h: addr;
};

type Idx: record {
    id: my_conn_id;
};

global conn_table: table[my_conn_id] of Conn::Info = table();

event Input::end_of_data(name: string, source: string) {
        print conn_table;
        terminate();
}

event zeek_init() {
    Input::add_table([$source="conn.log", $name="conn.log",
                      $idx=Idx, $val=Conn::Info, $destination=conn_table]);
    Input::remove("conn.log");
}

```

Depending on your use-case, for reading `conn.log`, you should probably use `uid: string` as an index instead of orig\_h/resp\_h. Alternatively, use `Input::add_event()` and act on every individual log line instead of building up a table.

Note that above snippet re-uses `Conn::Info` as value instead of a custom type.

Hope this helps.

---

<div class="post-metadata">

**Author:** ![bjeffries](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/bjeffries/32/687_2.png) [@bjeffries](https://community.zeek.org/u/bjeffries)\
**Post date:** [July 11, 2023, 12:43pm UTC](https://community.zeek.org/t/error-when-parsing-conn-log-field-name-into-table-with-input-framework/7086/4 "2023-07-11T12:43:11Z")

</div>

@awelzel Thank you so much Arne!