Skip to main content
Version: Next


Reads events from a Parquet file. Writes events to a Parquet file.





parquet [—compression-type=<type>] [—compression-level=<level>]


The parquet format provides both a parser and a printer for Parquet files.

Apache Parquet is a columnar storage format that a variety of data tools support.

MMAP Parsing

When using the parser with the file connector, we recommend passing the --mmap option to file to give the parser full control over the reads, which leads to better performance and memory usage.


Tenzir currently assumes that all Parquet files use metadata recognized by Tenzir. We plan to lift this restriction in the future.

--compression-type (Printer)

Specifies an optional compression type. Supported options are zstd for Zstandard compression, brotli for brotli compression, gzip for gzip compression, and snappy for snappy compression.

Why would I use this over the compress operator?

The Parquet format offers more efficient compression compared to the compress operator. This is because it compresses the data column-by-column, leaving metadata that needs to be accessed frequently uncompressed.

--compression-level (Printer)

An optional compression level for the corresponding compression type. This option is ignored if no compression type is specified.

Defaults to the compression type's default compression level.


Read a Parquet file via the from operator:

from file --mmap /tmp/data.prq read parquet

Write a Zstd-compressed Parquet file via to operator:

to /tmp/suricata.parquet write parquet --compression-type zstd