parsuri

README

parsuri

parsuri is a Go library to parse suricata eve.json files with proper marshaling.

Example

package main

import (
	"github.com/yunginnanet/parsuri"
	"log"
)

func main() {
	loader := parsuri.NewLoader()

	// Load the eve.json file asynchronously
	if err := loader.LoadOneFile("eve.json"); err != nil {
		log.Fatal(err)
	}

	// Range over the events and print dns answers to stdout
	for loader.More() {
		if err := loader.Err(); err != nil {
			log.Fatal(err)
		}
		event := loader.Event()
		if event.DNS != nil && !event.DNS.Empty() && event.DNS.Type == "answer" {
			log.Println(event.DNS)
		}
	}

	if err := loader.Err(); err != nil {
		log.Fatal(err)
	}
}

Credit

This is a rewrite of surevego.

License

• BSD-3 Copyright (c) 2017 Robert Haist

• BSD-3 Copyright (c) 2025 yunginnanet

Documentation

Index

• type Loader
  • func NewLoader() *Loader
  • func (l *Loader) Close() error
  • func (l *Loader) Err() error
  • func (l *Loader) Event() events.EveEvent
  • func (l *Loader) LoadFile(path string) error
  • func (l *Loader) LoadOneFile(path string) error
  • func (l *Loader) LoadSTDIN()
  • func (l *Loader) More() bool
  • func (l *Loader) ParseAndCloseAsync(r io.ReadCloser)
  • func (l *Loader) ParseAsync(r io.Reader)
  • func (l *Loader) Scan(r io.Reader)

Examples

• NewLoader

Types

type Loader

type Loader struct {
	// contains filtered or unexported fields
}

Loader is a struct that loads events from a file or stream asynchronously into a queue.

func NewLoader

func NewLoader() *Loader

Example

loader := NewLoader()

// Load the eve.json file asynchronously
if err := loader.LoadOneFile("pathto/eve.json"); err != nil {
	log.Fatal(err)
}

// Range over the events and print dns answers to stdout
for loader.More() {
	if err := loader.Err(); err != nil {
		log.Fatal(err)
	}
	event := loader.Event()
	if !event.DNS.Empty() && event.DNS.Type == "answer" {
		log.Println(event.DNS)
	}
}

if err := loader.Err(); err != nil {
	log.Fatal(err)
}

func (*Loader) Close

func (l *Loader) Close() error

Close closes the loader and prevents further processing. This will cause Loader.More to return false.

func (*Loader) Err

func (l *Loader) Err() error

Err clears the error slice and returns a single error.

func (*Loader) Event

func (l *Loader) Event() events.EveEvent

Event removes and returns the next events.EveEvent from the queue.

func (*Loader) LoadFile

func (l *Loader) LoadFile(path string) error

LoadFile loads a file, parses it, and closes it asynchronously. It does NOT call Loader.Close when finished, so Loader.More will return true.

func (*Loader) LoadOneFile

func (l *Loader) LoadOneFile(path string) error

LoadOneFile loads a file, parses it, and closes it asynchronously. It also calls Loader.Close when finished, causing Loader.More to return false.

func (*Loader) LoadSTDIN

func (l *Loader) LoadSTDIN()

LoadSTDIN loads from stdin and parses it asynchronously. It does NOT call Loader.Close when finished, so Loader.More will return true.

func (*Loader) More

func (l *Loader) More() bool

More returns true if there are more events to process.

func (*Loader) ParseAndCloseAsync

func (l *Loader) ParseAndCloseAsync(r io.ReadCloser)

ParseAndCloseAsync parses the input stream and closes it asynchronously. It also calls Loader.Close when finished, causing Loader.More to return false.

func (*Loader) ParseAsync

func (l *Loader) ParseAsync(r io.Reader)

ParseAsync parses the input stream asynchronously.

func (*Loader) Scan

func (l *Loader) Scan(r io.Reader)

Scan parses the input stream synchronously.