yield

Extracts nested records with the ability to unfold lists.

Synopsis

yield <extractor>

Description

The yield operator can be used to "zoom into" the extracted part of the incoming events. It can also return a new event for each element of a list.

<extractor>

The extractor must start with a field name. This can be followed by . and another field name, or by [] to extract all elements from the given list.

Examples

The schema suricata.dns provides a list of answers for DNS queries. Assume we want to extract all answers for CNAME records.

from eve.json
| where #schema == "suricata.dns"
| yield dns.answers[]
| where rrtype == "CNAME"