Skip to content

Tenzir supports reading from and writing to files, including non-regular files, such as Unix domain sockets, standard input, standard output, and standard error.

UnixDomainSocketstdoutstdinstderrJSONPCAPCSVread(2)mmap(2)write(2)

When ~ is the first character in the file path, the operator substitutes it with the $HOME environment variable.

Use from_file to read files with glob patterns, automatic format detection, and file monitoring. For writing, use save_file with a print operator.

Read from a file and parse it in the format implied by the file extension:

from_file "/tmp/file.json"

The operator automatically decompresses the file when the suffix list contains a supported compression algorithm:

from_file "/tmp/file.json.gz"
from_file "/var/log/*.json"

Use watch=true to continuously monitor for new files:

from_file "/var/log/app/*.json", watch=true

Write to a file in a specific format:

version
print_json
save_file "/tmp/tenzir-version.json"

With compression:

version
print_json
compress_bz2
save_file "/tmp/tenzir-version.json.bz2"

In case the file exists and you do not want to overwrite it, pass append=true as option:

from {x: 42}
print_csv
save_file "/tmp/event.csv", append=true

Pass uds=true to signal that the file is a Unix domain socket:

print_ndjson
save_file "/tmp/socket", uds=true

When reading from a Unix domain socket, use from_file with a parsing pipeline:

from_file "/tmp/socket" {
read_ndjson
}

Last updated: