You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Imagine a user has some Zeek NDJSON data and they want to bucket addresses into subnets. They first try to process the data without the assistance of any shaper.
$ zq -z 'put classnet=network_of(.id.resp_h) | count() by classnet | sort classnet' weird.ndjson.gz
put: a referenced field is missing
...
At this point they realize "oh shoot... this NDJSON has no rich typing!" To turn id into a nested record that includes the ip-typed fields like resp_h, they modify their command line to to apply the reference shaper for Zeek, but now receive a parse error:
$ zq -z -I ~/work/zed/zeek/shaper.zed 'put classnet=network_of(.id.resp_h) | count() by classnet | sort classnet' weird.ndjson.gz
zq: parse error: error parsing Z at line 114, col 1:type port=uint16;
The problem is that the shaper ends with put .=unflatten(.) | put . = shape(schemas[_path]), so for our additional put to succeed, the user needs to prepend a | in their additional Zed like so:
$ zq -z -I ~/work/zed/zeek/shaper.zed '| put classnet=network_of(.id.resp_h) | count() by classnet | sort classnet' weird.ndjson.gz
{classnet:"not an IPv4" (error),count:3 (uint64)} (=0)
{classnet:8.0.0.0/8,count:1 (uint64)} (=1)
{classnet:10.0.0.0/8,count:23889} (1)
...
It seems it would be helpful if the platform could figure out on its own when the | is necessary to stitch together the additional Zed top of the included Zed so the user doesn't have to make this adjustment.
The text was updated successfully, but these errors were encountered:
Repro is with
zed
commit 969f37d.Imagine a user has some Zeek NDJSON data and they want to bucket addresses into subnets. They first try to process the data without the assistance of any shaper.
At this point they realize "oh shoot... this NDJSON has no rich typing!" To turn
id
into a nested record that includes theip
-typed fields likeresp_h
, they modify their command line to to apply the reference shaper for Zeek, but now receive a parse error:The problem is that the shaper ends with
put .=unflatten(.) | put . = shape(schemas[_path])
, so for our additionalput
to succeed, the user needs to prepend a|
in their additional Zed like so:It seems it would be helpful if the platform could figure out on its own when the
|
is necessary to stitch together the additional Zed top of the included Zed so the user doesn't have to make this adjustment.The text was updated successfully, but these errors were encountered: