Robin Sommer

Not sure yet how the configuration would look like, but generally we'd offer a pre-defined set of fields to users that they can choose from. The default choice would remain...

What's the state here?

Good input, thanks. I'm wondering about the "broadcast" part of this: Zeek isn't good with 1-to-many communication, even at the IP level broadcast/multicast is problematic because it breaks the assumption...

> Some of this might also encroach on paraglob terrain. I was just about to mention paraglob: the motivation for that was of course to support indexing with a string...

I'm kind of thinking this might work best through an external package that adds code for what you'd like to see logged.

I have to say that the 4.0 semantics seem much more intuitive to me here, too; that's like any other language does it. The change in 4.1 leaves variable initializations...

> Would it be possible to have the failure message default to something sane/useful? My thought is just the Zeek script path and line number of the failure. Yeah, we...

@vpax do you have any thoughts in this?

> Did you also consider int64_t instead? Good question, we haven't discussed this any further yet, so something to think about. FWIW, we already don't support dates before 1970, so...

A good starting point might be just documenting all the casesl. People keep running into symptoms of this but I have to admit I can never even remember what exactly...