Skip to main content
Version: Tenzir v4.9

Formats

A format is the bridge between raw bytes and structured data. A format provides a parser and/or printer:

  1. Parser: translates raw bytes into structured event data
  2. Printer: translates structured events into raw bytes

Parsers and printers interact with their corresponding dual from a connector:

Formats appear as an argument to the read and write operators:

read <format>
write <format>

from <connector> [read <format>]
to <connector> [write <format>]

When a printer contructs raw bytes, it sets a MIME content type so that savers can make assumptions about the otherwise opaque content. For example, the http saver uses this value to populate the Content-Type header when copying the raw bytes into the HTTP request body.

The builtin printers set the following MIME types:

FormatMIME Type
CSVtext/csv
JSONapplication/json
NDJSONapplication/x-ndjson
Parquetapplication/x-parquet
PCAPapplication/vnd.tcpdump.pcap
SSVtext/plain
TSVtext/tab-separated-values
YAMLapplication/x-yaml
Zeek TSVapplication/x-zeek

Tenzir ships with the following formats: