type embedded_table: table[string] of string &read_expire=1sec;
global level2_table: table[string] of embedded_table;
global level1_table: table[string] of string &read_expire=1sec;
If I remember right, there's a problem with the expire attribute not
transferring over in such cases. See if something like this works:
event bro_init()
{
local t: table[string] of string &read_expire=1sec;
level2_table["t1"] = t;
[...]
}