🚀 Features
Section titled “🚀 Features”Support show nics to see network interfaces
Section titled “Support show nics to see network interfaces”You can now write show nics to get a list of network interfaces. Use show nics | select name to a get a list of possible interface names for from nic.
Support parsing of concatenated PCAPs
Section titled “Support parsing of concatenated PCAPs”The pcap parser can now process a stream of concatenated PCAP files. On the
command line, you can now parse traces with cat *.pcap | tenzir 'read pcap'.
When providing --emit-file-headers, each intermediate file header yields a
separate event.
The nic loader has a new option --emit-file-headers that prepends a PCAP
file header for every batch of bytes that the loader produces, yielding a
stream of concatenated PCAP files.
Implement the s3 connector
Section titled “Implement the s3 connector”Sep 15, 2023 · @Dakostu · #3496
The new s3 connector enables the user to import/export file data from/to S3
buckets.
Implement the GCS connector plugin
Section titled “Implement the GCS connector plugin”Sep 14, 2023 · @Dakostu · #3498
The new gcs connector enables the user to import/export file data from/to GCS
buckets.
Add lines parser
Section titled “Add lines parser”The new lines parser splits its input at newline characters and produces
events with a single field containing the line.
Add a round of loaders: http, https, ftp, ftps
Section titled “Add a round of loaders: http, https, ftp, ftps”The new connectors http, https, ftp, and ftps simplify using remote
files in pipelines via HTTP(S) and FTP(S).
Implement a ZeroMQ connector
Section titled “Implement a ZeroMQ connector”The new zmq connector ships with a saver and loader for interacting with
ZeroMQ. The loader (source) implements a connecting SUB socket and the saver
(sink) a binding PUB socket. The --bind or --connect flags make it
possible to control the direction of connection establishment.
🔧 Changes
Section titled “🔧 Changes”Do not drop the data field in decapsulate
Section titled “Do not drop the data field in decapsulate”Sep 19, 2023 · @dominiklohmann · #3515
The decapsulate operator no longer drops the PCAP packet data in incoming
events.
Support parsing of concatenated PCAPs
Section titled “Support parsing of concatenated PCAPs”The long option name --emit-file-header of the pcap parser is now called
--emit-file-headers (plural) to streamline it with the nic loader and the
new capability to process concatenated PCAP files.
🐞 Bug Fixes
Section titled “🐞 Bug Fixes”Bump submodule pointer to include pipeline manager deserialization update
Section titled “Bump submodule pointer to include pipeline manager deserialization update”Sep 1, 2023 · @Dakostu · #3487
Pipelines now show up in the “stopped” instead of the “created” state after the node restarted.