[Bro-Dev] How to use Broker::Data in an event handler?

Matthias Vallentin vallentin at icir.org
Mon Sep 10 06:00:21 PDT 2018

I'm trying to figure out if/how it is possible to use Broker::Data in an 
event handler as follows:

    event foo(x: Broker::Data)
      print x;

I'm trying to send an event via the Python bindings:

    event = broker.bro.Event("foo", broker.Data(42))
    endpoint.publish("/test", event)

However, Bro complains:

    warning: failed to convert remote event 'foo' arg #0, got integer, expected record

I tried both 

    event = broker.bro.Event("foo", 42)

and a wrapped version

    event = broker.bro.Event("foo", broker.Data(42))

and even

    event = broker.bro.Event("foo", broker.Data(broker.Data(42)))

but it seems that nesting is not possible.

The use case for having a Broker::Data in the Bro event handler is that 
the structure of the data is varying at runtime (similar to JSON).


(The code is a slightly adapted version from 

More information about the bro-dev mailing list