# &expire\_function Index data type on multi-index table

**URL:** <https://community.zeek.org/t/expire-function-index-data-type-on-multi-index-table/4879>\
**Category:** Zeek\
**Created:** [June 4, 2017, 3:47pm UTC](https://community.zeek.org/t/expire-function-index-data-type-on-multi-index-table/4879 "2017-06-04T15:47:54Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dave\_Crawford](https://avatars.discourse-cdn.com/v4/letter/d/919ad9/32.png) [@Dave\_Crawford](https://community.zeek.org/u/Dave_Crawford)\
**Post date:** [June 4, 2017, 3:47pm UTC](https://community.zeek.org/t/expire-function-index-data-type-on-multi-index-table/4879/1 "2017-06-04T15:47:54Z")

</div>

With the following table:

test\_expire\_table: table[string, addr] of set[string] &write\_expire=5sec &expire\_func=test\_expire\_func

What is the data type for the index variable when the expire function is called?

function test\_expire\_func(t: table[string, addr] of set[string], idx: ???): interval

If I set the idx type to any or string then print idx:

Test, 1.2.3.4

But trying to use it as an index produces an error:

print t[idx];  
not an index type (t[idx])

Thanks,  
-Dave

---

<div class="post-metadata">

**Author:** ![Jan](https://avatars.discourse-cdn.com/v4/letter/j/ce7236/32.png) [@Jan](https://community.zeek.org/u/Jan)\
**Post date:** [June 4, 2017, 5:47pm UTC](https://community.zeek.org/t/expire-function-index-data-type-on-multi-index-table/4879/2 "2017-06-04T17:47:56Z")

</div>

Hi Dave,

> With the following table:
> 
> test\_expire\_table: table[string, addr] of set[string] &write\_expire=5sec &expire\_func=test\_expire\_func
> 
> What is the data type for the index variable when the expire function is called?
> 
> function test\_expire\_func(t: table[string, addr] of set[string], idx: ???): interval
> 
> If I set the idx type to any or string then print idx:
> 
> Test, 1.2.3.4
> 
> But trying to use it as an index produces an error:

you can use a tuple-like syntax to get the index:

[i, j] = idx

Then you can use each part of the index separately or use both to access  
the table (c.f.  
[https://github.com/bro/bro/blob/master/scripts/base/frameworks/intel/main.bro#L254](https://github.com/bro/bro/blob/master/scripts/base/frameworks/intel/main.bro#L254)).

Jan

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:45pm UTC](https://community.zeek.org/t/expire-function-index-data-type-on-multi-index-table/4879/3 "2022-05-06T15:45:01Z")

</div>