base/frameworks/logging/writers/sqlite.zeek

LogSQLite

Interface for the SQLite log writer. Redefinable options are available to tweak the output format of the SQLite reader.

See SQLite Input/Logging for an introduction on how to use the SQLite log writer.

The SQL writer currently supports one writer-specific filter option via config: setting tablename sets the name of the table that is used or created in the SQLite database. An example for this is given in the introduction mentioned above.

Namespace

LogSQLite

Summary

Redefinable Options

LogSQLite::empty_field: string &redef

String to use for empty fields.

LogSQLite::set_separator: string &redef

Separator between set elements.

LogSQLite::unset_field: string &redef

String to use for an unset &optional field.

Detailed Interface

Redefinable Options

LogSQLite::empty_field
Type

string

Attributes

&redef

Default

"(empty)"

String to use for empty fields. This should be different from unset_field to make the output unambiguous.

LogSQLite::set_separator
Type

string

Attributes

&redef

Default

","

Separator between set elements.

LogSQLite::unset_field
Type

string

Attributes

&redef

Default

"-"

String to use for an unset &optional field.