vikgmdev commented on a change in pull request #47:
URL:
https://github.com/apache/metron-bro-plugin-kafka/pull/47#discussion_r428759769
##########
File path: README.md
##########
@@ -179,6 +179,48 @@ event zeek_init() &priority=-10
}
```
+#### Dynamically send each zeek log to a topic with its same name.
+
+ * ej. `CONN::LOG` logs are sent to the `conn` topic or `Known::CERTS_LOG` to
the `known-certs` topic.
+
+```
+@load packages/metron-bro-plugin-kafka/Apache/Kafka
+redef Kafka::logs_to_send = set(DHCP::LOG, RADIUS::LOG, DNS::LOG);
+redef Kafka::topic_name = "";
+redef Kafka::tag_json = T;
+
+event zeek_init() &priority=-10
+{
+ for (stream_id in Log::active_streams) {
+ # Convert stream type enum to string
+ const stream_string: string = fmt("%s", stream_id);
+
+ # replace `::` by `_` from the log string name
+ # ej. CONN::LOG to CONN_LOG or Known::CERTS_LOG to Known_CERTS_LOG
Review comment:
On it, thanks.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org
