TCP

The Transmission Control Protocol (TCP) provides a bidirectional byte stream over IP. Tenzir provides operators for both sides of a TCP conversation: connecting to remote endpoints, accepting incoming connections, and serving data to connected clients.

Use the IP address 0.0.0.0 to listen on all available network interfaces.

Connecting to remote endpoints

Use from_tcp to connect to a remote TCP endpoint as a client and read data from it, or to_tcp to send data to a remote endpoint. Both operators reconnect automatically with exponential backoff on connection failure.

The to_tcp operator uses a printing subpipeline to serialize events into bytes. Use format writers such as write_ndjson for common wire formats. For protocols that expect an explicit delimiter after each message, print the event to a string and frame it with write_delimited:

to_tcp "collector.example.com:9000" {
  write_delimited this.print_ndjson(strip_null_fields=true), "\x00"
}

Accepting incoming connections

Use accept_tcp to listen on a local endpoint and accept incoming TCP connections. Each connection spawns a nested pipeline that processes the incoming byte stream independently. Inside that pipeline, $peer.ip and $peer.port describe the connected client. Set resolve_hostnames=true to also expose $peer.hostname from reverse DNS.

Serving data to clients

Use serve_tcp to start a TCP server that broadcasts pipeline output to all connected clients. A nested pipeline serializes events into bytes before sending.

See Get data from the network for practical examples.

SSL/TLS

All TCP operators support TLS via the tls option. Pass an empty record (tls={}) for defaults, or provide specific options like certfile and keyfile.