Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adding &optional to zeek records question #135

Open
zrobinette12 opened this issue Jul 9, 2024 · 1 comment
Open

Adding &optional to zeek records question #135

zrobinette12 opened this issue Jul 9, 2024 · 1 comment
Assignees
Labels
enhancement New feature or request

Comments

@zrobinette12
Copy link

Hello, was there a specific reason to not use &optional on several of the ja4 zeek records such as here? https://github.com/FoxIO-LLC/ja4/blob/main/zeek/ja4t/main.zeek#L42.

When writing JSON logs, it ends up looking like this in the JSON message if there's no value for JA4T and others that may not get recorded for a specific connection. "ja4t": "".

When adding &optional, the key/value just doesn't get written out instead of it being there but empty.

@john-althouse john-althouse added the enhancement New feature or request label Jul 18, 2024
@john-althouse
Copy link
Collaborator

@J0eJ0h I tend to agree with this, no reason to log a blank field. What do you think?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

3 participants