[Zeek-Dev] support for event handlers using a subset of parameters

Robin Sommer robin at corelight.com
Tue Feb 5 17:40:10 PST 2019

On Fri, Feb 01, 2019 at 11:17 -0600, Jonathan Siwek wrote:

> > > >     global my_event: event(a: count, b: string);
> > > >     event my_event(b: string)
> > > >         { print "my_event", b; }

> Did it look like an error in the sense of the user making a mistake or
> in the sense of traditional way functions in other languages like
> C/C++ require matching signatures?

It's probably the latter, but I'm not sure that helps: when I see the
above code, I wonder: "Heck, why is that working ... Or, wait, maybe
it isn't?". It makes it confusing to me to read the code.

If at least the prototype told me somehow "it's ok if parameters are
left off", then I'd have a clue that everything is fine.

The following would be even worst in terms of confusion:

    global my_event: event(a: string, b: string);
    event my_event(b: string)

Now I need to know if the language goes by order of parameters or by
parameter name.

I do see the appeal of making things just work when event handlers
change, but is there really no different way to support that?

(I don't have an opinion on the event overloading discussion yet, need
to digest that more)


Robin Sommer * Corelight, Inc. * robin at corelight.com * www.corelight.com

More information about the zeek-dev mailing list