Right now, Bro will print scientific notation in JSON logs but we've always tended to avoid it in the standard Bro log format. What does everyone think about switching to allow scientific notation in the standard log format? Daniel recently did some exploration of various versions of awk and they all support scientific notation (I think that was part of my concern a long time ago).
Thoughts?
.Seth
I'm wondering if that's true for other log parsers as well. The main
thing I'd want to avoid is breaking people's existing scripts. We
could make it an option?
Robin
Actually, right now Bro uses scientific notation in JSON logs only
for very large values (such as 3.1e+15). For values very close to
zero (such as 1.2e-7), Bro will write "0" to a JSON log.
How about a user redef’able format string for doubles in logs? Even more flexible would be to make it a function. Let the user decide the format they need, and adapt their scripts accordingly, with the default being the current behavior.
Ah, I like that idea. I think the current logs (both JSON formatted and normal Bro format) are fine for most people, but for the people that actually want doubles displayed differently this could give them that option.
.Seth