file analysis extraction analyzer

This is mostly intended for Jon, but I thought it'd be nice for everyone to see it.

Jon, what do you think about adding extraction events for when an extraction begins and ends? They could be events like this…

event file_extract_begin(f: fa_file, tag: Analyzer, args: AnalyzerArgs)
event file_extract_end(f: fa_file, tag: Analyzer, args: AnalyzerArgs)

I know that the events don't match how the core works (by splitting $tag out of args) but that's more along the lines of how I'm making the script land API look so I think it makes sense to split the event arguments out that way. This makes it much easier to write some of the scripts and should generally provide good feedback from the file extraction "analyzer". :slight_smile:

  .Seth

Generally sounds fine, but why is the tag needed? Unless there's plans to be different kinds of file extraction analyzers that re-use those events, won't it always be the same tag? Similarly, do you need the full args since the only relevant part of it is the file/path name?

- Jon

After talking yesterday we both came to the conclusion that we should just add a single event that looks like this…

event file_extract_end(f: fa_file, filename: string)

This way we'll be able to spool currently downloading files into a temporary location and move them to their final location when the extraction is finished (and perhaps most importantly, do it all at script land).

  .Seth

Sigh, I'm already reconsidering this. There is no functional difference between this and the file_state_remove event except for the filename which I should have available elsewhere within the fa_file record. Let me stew on this a bit more.

  .Seth