trying to read space separate file to bro

Zeek
1

Hi
I am trying to read file which has space separate

I add redef separator = " " ; but it’s gave me some errors

error: ./aaa.txt/Input::READER_ASCII: Did not find requested field sip in input data file ./aaa.txt.

error: ./aaa.txt/Input::READER_ASCII: Init: cannot open ./aaa.txt; headers are incorrect

error: ./aaa.txt/Input::READER_ASCII: Init failed

if aaa.txt is tsv file and with out redef separator, it works fine

Is there a way to read a file which is not tsv

here is my sample aaa.txt and bro script

aaa.txt

#fields sip sport dip dport

192.168.1.116 61711 172.16.100.132 22

bro script

export {

type Val: record {

sip: addr;

sport: port;

dip: addr;

dport: port;

};

redef Input::separator = " ";

}

event TEST(description: Input::EventDescription, tpe: Input::Event, sip: addr, sport: port, dip: addr, dport: port){

print fmt(“%s %d %s %d”,sip,sport,dip,dport);

}

event bro_init()

{

print fmt(“test”);

Input::add_event([$source=“./aaa.txt”, $name=“test”, $fields=Val, $ev=TEST ,$want_record=F]);

}

2

In your script, you need to change one line to use this:

redef InputAscii::separator = " ";

3

You need to be careful with this setting too. It's easy to mess up other activities (like intelligence import) if you do a setting like this globally. There is a $config field in the input description where you should be able to specify that field too.

.Seth

4

Good point, Seth. Here is an example of how to use the $config field:

Input::add_event([$source="./aaa.txt", $name="test", $fields=Val,
                   $ev=TEST, $want_record=F,
                   $config=table(["separator"]=" ")]);

5

It works perfectly

thank you very much