We are currently writing code for ingesting data directly using Broker’s API.
From the docs, it seems that Broker assumes that publishers and subscribers
somehow agree on one layout per topic: "senders and receivers will need to
agree on a specific data layout for the values exchanged, so that they
interpret them in the same way.” [1]
This raises a couple of questions. Primarily: where can Broker users learn the
layouts to interpret received data? There’s essentially no hope in deferring a
layout, since broker::data doesn’t include any meta information such as field
names. Is meta information stored somewhere? Is there a convention how to place
and retrieve such meta information in Broker’s data stores? How does Bro itself
make such information available? Is there a document that lists all topics used
by Bro with their respective broker::data layout?
Dominik
[1] https://bro-broker.readthedocs.io/en/stable/comm.html#exchanging-bro-events
<https://bro-broker.readthedocs.io/en/stable/comm.html#exchanging-bro-events>_______________________________________________
bro-dev mailing list
bro-dev@bro.org
http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
