parsuri

README

parsuri

parsuri is a Go library to parse suricata eve.json files with proper marshaling.

Example

package main

import (
	"github.com/yunginnanet/parsuri"
	"log"
)

func main() {
	loader := parsuri.NewLoader()

	// Load the eve.json file asynchronously
	if err := loader.LoadFile("eve.json"); err != nil {
		log.Fatal(err)
	}

	// Range over the events and print dns answers to stdout
	for loader.More() {
		if err := loader.Err(); err != nil {
			log.Fatal(err)
		}
		event := loader.Event()
		if event.DNS != nil && !event.DNS.Empty() && event.DNS.Type == "answer" {
			log.Println(event.DNS)
		}
	}

	if err := loader.Err(); err != nil {
		log.Fatal(err)
	}
}

Credit

This is a rewrite of surevego.

License

• BSD-3 Copyright (c) 2017 Robert Haist

• BSD-3 Copyright (c) 2025 yunginnanet

Documentation

Index

• type Loader
  • func NewLoader() *Loader
  • func (l *Loader) Err() error
  • func (l *Loader) Event() events.EveEvent
  • func (l *Loader) LoadFile(path string) error
  • func (l *Loader) More() bool
  • func (l *Loader) ParseReaderAsynchronously(r io.ReadCloser) error

Examples

• NewLoader

Types

type Loader

type Loader struct {
	// contains filtered or unexported fields
}

Loader is a struct that loads events from a file or stream asynchronously into a queue.

func NewLoader

func NewLoader() *Loader

Example

loader := NewLoader()

// Load the eve.json file asynchronously
if err := loader.LoadFile("pathto/eve.json"); err != nil {
	log.Fatal(err)
}

// Range over the events and print dns answers to stdout
for loader.More() {
	if err := loader.Err(); err != nil {
		log.Fatal(err)
	}
	event := loader.Event()
	if !event.DNS.Empty() && event.DNS.Type == "answer" {
		log.Println(event.DNS)
	}
}

if err := loader.Err(); err != nil {
	log.Fatal(err)
}

func (*Loader) Err

func (l *Loader) Err() error

Err clears the error slice and returns a single error.

func (*Loader) Event

func (l *Loader) Event() events.EveEvent

Event removes and returns the next events.EveEvent from the queue.

func (*Loader) LoadFile

func (l *Loader) LoadFile(path string) error

func (*Loader) More

func (l *Loader) More() bool

More returns true if there are more events to process.

func (*Loader) ParseReaderAsynchronously

func (l *Loader) ParseReaderAsynchronously(r io.ReadCloser) error