A format is the bridge between raw bytes and structured data. A format provides a parser and/or printer:
- Parser: translates raw bytes into structured event data
- Printer: translates structured events into raw bytes
Parsers and printers interact with their corresponding dual from a connector:
from <connector> [read <format>]
to <connector> [write <format>]
When a printer contructs raw bytes, it sets a
MIME content type so that savers
can make assumptions about the otherwise opaque content. For example, the
http saver uses this value to populate the
Content-Type header when copying the raw bytes into the HTTP request body.
The builtin printers set the following MIME types:
Tenzir ships with the following formats:
Parses events in the Common Event Format (CEF).
The csv format is a configuration of the xsv format:
Reads and writes the Feather file format.
Reads Graylog Extended Log Format (GELF) events.
Parses a string using a grok-pattern, backed by regular expressions.
Reads and writes JSON.
Reads key-value pairs by splitting strings based on regular expressions.
Parses and prints events as lines.
Reads events from a Parquet file. Writes events to a Parquet file.
Reads and writes raw network packets in PCAP file format.
The ssv format is a configuration of the xsv format:
Reads Suricata's EVE JSON output. The parser is an alias
Reads syslog messages.
Parses a datetime/timestamp using a strptime-like format string.
The tsv format is a configuration of the xsv format:
Reads and writes lines with separated values.
Reads and writes YAML.
The zeek-json format is an alias for json with the arguments:
Reads and writes Zeek tab-separated values.