-
-
Notifications
You must be signed in to change notification settings - Fork 93
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add a get subcommand to retrieve events from the archive directly #938
Conversation
b03696d
to
796330b
Compare
796330b
to
89830d1
Compare
4ff55ad
to
2cbf312
Compare
2a04081
to
a6ee430
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This is mostly looking fine, I just have minor stuff:
- zeek-to-vast seems to be missing an include (that used to be available transitively).
- please add to vast.yaml.example, rebase onto master, and use
vast.get.format
overget.format
.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I've got a bunch of small requests.
Tested this locally and it works as expected.
This commit consolidates the creation of writers and sinks. The sink function itself still needs to be moved to its own TU. This will be done in the next commit so this one is easier to review.
Co-authored-by: Dominik Lohmann <mail@dominiklohmann.de>
3ed882c
to
d678599
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Approving, but please improve the changelog entry.
Please note that we do not necessarily need to merge this, it is just a tool to simplify the investigation of latency issues of
vast export
. The actual fix will come in a different PR after the issue is identified.