Download the release on GitHub.
Features
Section titled “Features”Add a round of loaders: http, https, ftp, ftps
Section titled “Add a round of loaders: http, https, ftp, ftps”The new connectors http, https, ftp, and ftps simplify using remote
files in pipelines via HTTP(S) and FTP(S).
Support parsing of concatenated PCAPs
Section titled “Support parsing of concatenated PCAPs”The pcap parser can now process a stream of concatenated PCAP files. On the
command line, you can now parse traces with cat *.pcap | tenzir 'read pcap'.
When providing --emit-file-headers, each intermediate file header yields a
separate event.
The nic loader has a new option --emit-file-headers that prepends a PCAP
file header for every batch of bytes that the loader produces, yielding a
stream of concatenated PCAP files.
Implement the GCS connector plugin
Section titled “Implement the GCS connector plugin”The new gcs connector enables the user to import/export file data from/to GCS
buckets.
Support show nics to see network interfaces
Section titled “Support show nics to see network interfaces”You can now write show nics to get a list of network interfaces. Use show nics | select name to a get a list of possible interface names for from nic.
Add lines parser
Section titled “Add lines parser”The new lines parser splits its input at newline characters and produces
events with a single field containing the line.
Implement a ZeroMQ connector
Section titled “Implement a ZeroMQ connector”The new zmq connector ships with a saver and loader for interacting with
ZeroMQ. The loader (source) implements a connecting SUB socket and the saver
(sink) a binding PUB socket. The --bind or --connect flags make it
possible to control the direction of connection establishment.
Implement the s3 connector
Section titled “Implement the s3 connector”The new s3 connector enables the user to import/export file data from/to S3
buckets.
Changes
Section titled “Changes”Do not drop the data field in decapsulate
Section titled “Do not drop the data field in decapsulate”The decapsulate operator no longer drops the PCAP packet data in incoming
events.
By @dominiklohmann in #3515.
Support parsing of concatenated PCAPs
Section titled “Support parsing of concatenated PCAPs”The long option name --emit-file-header of the pcap parser is now called
--emit-file-headers (plural) to streamline it with the nic loader and the
new capability to process concatenated PCAP files.
Bug Fixes
Section titled “Bug Fixes”Bump submodule pointer to include pipeline manager deserialization update
Section titled “Bump submodule pointer to include pipeline manager deserialization update”Pipelines now show up in the “stopped” instead of the “created” state after the node restarted.