Skip to content

decompress

Decompresses a stream of bytes.

decompress codec:string

Deprecated

The decompress operator is deprecated. You should use the bespoke operators instead.

The decompress operator decompresses bytes in a pipeline incrementally with a known codec. The operator supports decompressing multiple concatenated streams of the same codec transparently.

An identifier of the codec to use. Currently supported are brotli, bz2, gzip, lz4, and zstd.

Import Suricata events from a Zstd-compressed file

Section titled “Import Suricata events from a Zstd-compressed file”
load_file "eve.json.zst"
decompress "zstd"
read_suricata
import

Convert a Zstd-compressed file into an LZ4-compressed file

Section titled “Convert a Zstd-compressed file into an LZ4-compressed file”
load_file "in.zst"
decompress "zstd"
compress "lz4"
save_file "out.lz4"

Last updated: