[Bro] select element of set of records

Reinhard Gentz rgentz at asu.edu
Tue Nov 15 12:43:57 PST 2016


Hi

I want to send one element of a set of records to a remote event via broker
to python. But i can only set the complete set of records

The code below works, but i receive all elements of the set of records, not
just the one i want to select. When I execute the code below on the other
side i receive  {(whatever, 1), (whatever, 2)} but i only want to receive
{(whatever, 1)}. I know i can filter out the unnecessary data in python,
but it seems wasteful of the bandwidth and computation needed.

type mytest: record{
        a: string &default = "whatever";
        b: string &default= "inhere";
};
type myrecordset: set[mytest];
local myrecord2 = myrecordset([$b="1"],[$b="2"]);

global my_event3: event(msg: myrecordset);

Broker::send_event("bro/events/my_event", Broker::event_args(my_event3,m
yrecord2[mytest($b="1")]));
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20161115/bf225ed4/attachment.html 


More information about the Bro mailing list