A format is the bridge between raw bytes and structured data. A format provides a parser and/or printer:
- Parser: translates raw bytes into structured event data
- Printer: translates structured events into raw bytes
Parsers and printers interact with their corresponding dual from a connector:
read <format> [from <connector>]
write <format> [to <connector>]
If the connector is omitted, the default is
Tenzir ships with the following formats:
Parses events in the Common Event Format (CEF).
The csv format is a configuration of the xsv format:
Reads and writes the Feather file format.
Reads and writes JSON.
Parses events as lines.
Reads NetFlow v5, v9, and IPFIX.
Reads events from a Parquet file. Writes events to a Parquet file.
Reads and writes raw network packets in PCAP file format.
The ssv format is a configuration of the xsv format:
Reads Suricata's EVE JSON output. The parser is an alias
The tsv format is a configuration of the xsv format:
Reads and writes lines with separated values.
The zeek-json format is an alias for json with the arguments:
Reads and writes Zeek tab-separated values.