Skip to content

publish

Publishes events to a channel with a topic.

publish [topic:string]

The publish operator publishes events at a node in a channel with the specified topic. All subscribers of the channel operator receive the events immediately.

An optional topic for publishing events under. If unspecified, the operator publishes events to the topic main.

Publish Zeek connection logs under the fixed topic zeek

Section titled “Publish Zeek connection logs under the fixed topic zeek”
from "conn.log.gz" {
decompress_gzip
read_zeek_tsv
}
publish "zeek"

Publish Suricata events under a dynamic topic depending on their event type

Section titled “Publish Suricata events under a dynamic topic depending on their event type”
from "eve.json" {
read_suricata
}
publish f"suricata.{event_type}"

import, subscribe

Last updated: