Docker run -e vars --> bro config vars

[Jouster500]

Same thing as issue #3, but suggesting to have "docker run -e" vars to be linked to bro config vars. For example; docker run -e use_json=T will set in the bro logger file (your image has it written in /usr/local/share/bro/base/frameworks/logging/writers/ascii.bro) line 27, const use_json = T &redef.

[blacktop]

I like where your heads at! This is a little more complicated than things I have done in the path because this technique works well with a single config file, but there are a LOT of files that could be changed this way??

I have an idea on how it could work:

docker run -e base.frameworks.logging.writers.ascii.use_json=T

What do you think?

[Jouster500]

Yeah something like that could work, however if a user has to make multiple changes to a particular config file, then there would have to be multiple lines of redundant characters, so for instance; docker run -e base.frameworks.logging.writers.ascii.use_json=T -e base.frameworks.logging.writers.ascii.json_timestamps="JSON::TimestampFormat = JSON::TS_EPOCH" ... For however many configs the user wants to change. Try seeing if you can limit that down to just logname.variable=value.

The other option is to have users pass their own config file with -v, provided all necessary configs are met with it, otherwise default to yours.

[danielguerra69]

I would use a .env file and a docker-compose.yml to set the containers env variables.