broker icon indicating copy to clipboard operation
broker copied to clipboard

Make broker::data_envelope::deserialize() for JSON format accessible

Open awelzel opened this issue 1 year ago • 1 comments

I have found that I can parse Zeek events from arbitrary v1 binary format byte buffers with the following snippet:

    auto r = broker::data_envelope::deserialize(broker::endpoint_id::nil(), broker::endpoint_id::nil(), 0, "", payload,
                                                payload_size);
    if ( ! r )
        return std::nullopt;

    broker::zeek::Event ev(std::move(*r));

I have also found that I should be able to serialize Zeek events into v1 JSON byte buffers as follows:

    auto ev = broker::zeek::Event(event.HandlerName(), std::move(xs), broker::to_timestamp(event.timestamp));
    broker::format::json::v1::encode(ev.move_data(), std::back_inserter(buf));

Going from JSON to back to a broker::zeek::Event however isn't accessible unless I've missed something. I've found the following place though:

https://github.com/zeek/broker/blob/861c20612e8b28811458ff9a96f091cc6de0c005/src/internal/json_client.cc#L126-L142

Could this be lifted into an API so that de-serialization can be re-used outside of json_client? Getting back the broker::data_message_ptr after the de-re-serialization step would be great.

Background is re-using the same serialization format over a different transport, which works for the binary format.

awelzel avatar Mar 06 '24 20:03 awelzel

Could this be lifted into an API so that de-serialization can be re-used outside of json_client?

Sure, I'll take care of it.

Neverlord avatar Mar 07 '24 13:03 Neverlord