zed

package module
v0.32.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Nov 3, 2021 License: BSD-3-Clause Imports: 18 Imported by: 21

README ¶

Zed Tests GoPkg

Zed is a new kind of data lake that provides lightweight search and analytics for semi-structured data (like JSON) as well as structured data (like relational tables) all in the same package.

Check out the Zed FAQ.

Why?

We think that you shouldn't have to set up one system for search and another completely different system for historical analytics. And the same search/analytics system that works at cloud scale should run easily as a lightweight command-line tool on your laptop.

And rather than having to set up complex ETL pipelines with brittle transformation logic, managing your data lake should be as easy as git.

And while schemas are a great way to model and organize your data, they often get in the way when you are just trying to store or transmit your semi-structured data.

Finally, we believe a lightweight data store that provides easy search and analytics would be a great place to store data sets for data science and data engineering experiments running in Python and providing easy integration with your favorite Python libraries.

How?

Zed solves all these problems with a new format called ZSON, which is a superset of JSON and the relational models. ZSON is syntax-compatible with JSON but it has a comprehensive type system that you can use as little or as much as you like. Zed types can be used as schemas.

Zed also has a cloud-based object design that was modeled after the git design pattern. Commits to the lake are transactional and consistent. Search index updates are also transactionally consistent with any ingested data, and searches can run with or without indexes.

Quick Start

Detailed documentation is available.

The quickest way to get running on macOS, Linux, or Windows is to download a pre-built release binary. You can find these binaries on the GitHub releases page.

Once installed, you can run the query engine from the command-line using zq:

echo '{"s":"hello, world"}' | zq -Z -

Or you can run a Zed lake server, load it with data using zapi, and hit the API. In one shell, run the server:

mkdir scratch
zed lake serve -R scratch

And in another shell, run the client:

zapi create Demo
zapi use Demo@main
echo '{s:"hello, world"}' | zapi load -
zapi query "from Demo"

You can also use zed from Python. After you install the Zed Python:

pip3 install "git+https://github.com/brimdata/zed#subdirectory=python/zed"

You can hit the Zed service from a Python program:

import zed

# Connect to the REST API at the default base URL (http://127.0.0.1:9867).
# To use a different base URL, supply it as an argument.
client = zed.Client()

# Begin executing a Zed query for all records in the pool named "Demo".
# This returns an iterator, not a container.
records = client.query('from Demo')

# Stream records from the server.
for record in records:
    print(record)

See the python/zed for more details.

Brim

You can use the Brim app to explore, query, and shape the data in your Zed lake.

We originally developed Brim for security-oriented use cases (having tight integration with Zeek, Suricata, and Wireshark), but we are actively extending Brim with UX for handling generic data sets to support data science, data engineering, and ETL use cases.

Building from Source

It's also easy to build zed from source:

git clone https://github.com/brimdata/zed
cd zed
make install

This installs binaries in your $GOPATH/bin.

If you don't have Go installed, download and install it from the Go install page. Go version 1.16 or later is required.

Contributing

See the contributing guide on how you can help improve Zed!

Join the Community

Join our Public Slack workspace for announcements, Q&A, and to trade tips!

Acknowledgment

We modeled this README after Philip O'Toole's brilliantly succinct description of rqlite.

Documentation ¶

Overview ¶

Package zng implements a data typing system based on the zeek type system. All zeek types are defined here and implement the Type interface while instances of values implement the Value interface. All values conform to exactly one type. The package provides a fast-path for comparing a value to a byte slice without having to create a zeek value from the byte slice. To exploit this, all values include a Comparison method that returns a Predicate function that takes a byte slice and a Type and returns a boolean indicating whether the the byte slice with the indicated Type matches the value. The package also provides mechanism for coercing values in well-defined and natural ways.

Index ¶

Constants ¶

View Source
const (
	MaxColumns     = 100_000
	MaxEnumSymbols = 100_000
	MaxUnionTypes  = 100_000
)
View Source
const (
	IDUint8    = 0
	IDUint16   = 1
	IDUint32   = 2
	IDUint64   = 3
	IDInt8     = 4
	IDInt16    = 5
	IDInt32    = 6
	IDInt64    = 7
	IDDuration = 8
	IDTime     = 9
	IDFloat16  = 10
	IDFloat32  = 11
	IDFloat64  = 12
	IDDecimal  = 13
	IDBool     = 14
	IDBytes    = 15
	IDString   = 16
	IDBstring  = 17
	IDIP       = 18
	IDNet      = 19
	IDType     = 20
	IDError    = 21
	IDNull     = 22

	IDTypeDef = 23 // 0x17

	IDTypeName   = 24 // 0x18
	IDTypeRecord = 25 // 0x19
	IDTypeArray  = 26 // 0x20
	IDTypeSet    = 27 // 0x21
	IDTypeUnion  = 28 // 0x22
	IDTypeEnum   = 29 // 0x23
	IDTypeMap    = 30 // 0x24
)
View Source
const (
	CtrlValueEscape   = 0xf5
	TypeDefRecord     = 0xf6
	TypeDefArray      = 0xf7
	TypeDefSet        = 0xf8
	TypeDefUnion      = 0xf9
	TypeDefEnum       = 0xfa
	TypeDefMap        = 0xfb
	TypeDefAlias      = 0xfc
	CtrlCompressed    = 0xfd
	CtrlAppMessage    = 0xfe
	CtrlEOS           = 0xff
	AppEncodingZNG    = 0
	AppEncodingJSON   = 1
	AppEncodingZSON   = 2
	AppEncodingString = 3
	AppEncodingBinary = 4
)

Variables ¶

View Source
var (
	ErrExhausted = errors.New("called Next() on iterator after last record")
	ErrMismatch  = errors.New("mismatch between record type and value")
)
View Source
var (
	ErrMissingField   = errors.New("record missing a field")
	ErrExtraField     = errors.New("record with extra field")
	ErrNotContainer   = errors.New("expected container type, got primitive")
	ErrNotPrimitive   = errors.New("expected primitive type, got container")
	ErrTypeIDExists   = errors.New("zng type ID exists")
	ErrTypeIDInvalid  = errors.New("zng type ID out of range")
	ErrBadValue       = errors.New("malformed zng value")
	ErrBadFormat      = errors.New("malformed zng record")
	ErrTypeMismatch   = errors.New("type/value mismatch")
	ErrColumnMismatch = errors.New("zng record mismatch between columns in type and columns in value")
	ErrCorruptColumns = errors.New("wrong number of columns in zng record value")
)
View Source
var (
	ErrLenUnset      = errors.New("len(unset) is undefined")
	ErrNotArray      = errors.New("cannot index a non-array")
	ErrIndex         = errors.New("array index out of bounds")
	ErrUnionSelector = errors.New("union selector out of bounds")
	ErrEnumIndex     = errors.New("enum index out of bounds")
)
View Source
var (
	TypeUint8    = &TypeOfUint8{}
	TypeUint16   = &TypeOfUint16{}
	TypeUint32   = &TypeOfUint32{}
	TypeUint64   = &TypeOfUint64{}
	TypeInt8     = &TypeOfInt8{}
	TypeInt16    = &TypeOfInt16{}
	TypeInt32    = &TypeOfInt32{}
	TypeInt64    = &TypeOfInt64{}
	TypeDuration = &TypeOfDuration{}
	TypeTime     = &TypeOfTime{}
	// XXX add TypeFloat16
	TypeFloat32 = &TypeOfFloat32{}
	TypeFloat64 = &TypeOfFloat64{}
	// XXX add TypeDecimal
	TypeBool    = &TypeOfBool{}
	TypeBytes   = &TypeOfBytes{}
	TypeString  = &TypeOfString{}
	TypeBstring = &TypeOfBstring{}
	TypeIP      = &TypeOfIP{}
	TypeNet     = &TypeOfNet{}
	TypeType    = &TypeOfType{}
	TypeError   = &TypeOfError{}
	TypeNull    = &TypeOfNull{}
)
View Source
var (
	ErrNotNumber  = errors.New("not a number")
	ErrTypeSyntax = errors.New("syntax error parsing type string")
)
View Source
var (
	ErrAliasExists = errors.New("alias exists with different type")
)
View Source
var ErrDuplicateFields = errors.New("duplicate fields")
View Source
var ErrIncomplete = errors.New("not enough values supplied to complete record")
View Source
var ErrMissing = errors.New(missing)

ErrMissing is returned by entities that fail because a referenced field was missing or because an argument to the entity had a missing value. This is used at sites in the code where it is unknown whether the outcome should result in a runtime exit or in continued execution with a Missing value embedded in the Zed results.

View Source
var ErrNonAdjacent = errors.New("non adjacent fields")
View Source
var False = Value{TypeBool, []byte{0}}

Missing is value that represents the error condition that a field referenced was not present. The Missing value can be propagated through functions and expressions and each operator must clearly defined its semantics with respect to the Missing value. For example, "true AND MISSING" is MISSING.

View Source
var SkipContainer = errors.New("skip this container")

SkipContainer is used as a return value from Visitors to indicate that the container passed in the call should not be visited. It is not returned as an error by any function.

View Source
var True = Value{TypeBool, []byte{1}}

Functions ¶

func AppendBool ¶

func AppendBool(zb zcode.Bytes, b bool) zcode.Bytes

func AppendDuration ¶

func AppendDuration(bytes zcode.Bytes, d nano.Duration) zcode.Bytes

func AppendFloat32 ¶

func AppendFloat32(zb zcode.Bytes, f float32) zcode.Bytes

func AppendFloat64 ¶

func AppendFloat64(zb zcode.Bytes, d float64) zcode.Bytes

func AppendIP ¶

func AppendIP(zb zcode.Bytes, a net.IP) zcode.Bytes

func AppendInt ¶

func AppendInt(bytes zcode.Bytes, i int64) zcode.Bytes

func AppendNet ¶

func AppendNet(zb zcode.Bytes, subnet *net.IPNet) zcode.Bytes

func AppendTime ¶

func AppendTime(bytes zcode.Bytes, t nano.Ts) zcode.Bytes

func AppendUint ¶

func AppendUint(bytes zcode.Bytes, i uint64) zcode.Bytes

func BuildUnion ¶

func BuildUnion(b *zcode.Builder, selector int, val zcode.Bytes, container bool)

BuildUnion appends to b a union described by selector, val, and container.

func ContainedType ¶

func ContainedType(typ Type) (Type, []Column)

ContainedType returns the inner type for set and array types in the first return value and the columns of its of type for record types in the second return value. ContainedType returns nil for both return values if the type is not a set, array, or record.

func DecodeBool ¶

func DecodeBool(zv zcode.Bytes) (bool, error)

func DecodeBytes ¶

func DecodeBytes(zv zcode.Bytes) ([]byte, error)

func DecodeDuration ¶

func DecodeDuration(zv zcode.Bytes) (nano.Duration, error)

func DecodeError ¶

func DecodeError(zv zcode.Bytes) (error, error)

func DecodeFloat ¶

func DecodeFloat(zb zcode.Bytes) (float64, error)

func DecodeFloat32 ¶

func DecodeFloat32(zb zcode.Bytes) (float32, error)

func DecodeFloat64 ¶

func DecodeFloat64(zv zcode.Bytes) (float64, error)

func DecodeIP ¶

func DecodeIP(zv zcode.Bytes) (net.IP, error)

func DecodeInt ¶

func DecodeInt(zv zcode.Bytes) (int64, error)

func DecodeNet ¶

func DecodeNet(zv zcode.Bytes) (*net.IPNet, error)

func DecodeString ¶

func DecodeString(zv zcode.Bytes) (string, error)

func DecodeTime ¶

func DecodeTime(zv zcode.Bytes) (nano.Ts, error)

func DecodeUint ¶

func DecodeUint(zv zcode.Bytes) (uint64, error)

func EncodeBool ¶

func EncodeBool(b bool) zcode.Bytes

func EncodeBytes ¶

func EncodeBytes(b []byte) zcode.Bytes

func EncodeDuration ¶

func EncodeDuration(d nano.Duration) zcode.Bytes

func EncodeError ¶

func EncodeError(err error) zcode.Bytes

func EncodeFloat32 ¶

func EncodeFloat32(d float32) zcode.Bytes

func EncodeFloat64 ¶

func EncodeFloat64(d float64) zcode.Bytes

func EncodeIP ¶

func EncodeIP(a net.IP) zcode.Bytes

func EncodeInt ¶

func EncodeInt(i int64) zcode.Bytes

func EncodeNet ¶

func EncodeNet(subnet *net.IPNet) zcode.Bytes

func EncodeString ¶

func EncodeString(s string) zcode.Bytes

func EncodeTime ¶

func EncodeTime(t nano.Ts) zcode.Bytes

func EncodeTypeValue ¶

func EncodeTypeValue(t Type) zcode.Bytes

func EncodeUint ¶

func EncodeUint(i uint64) zcode.Bytes

func FormatTypeValue ¶

func FormatTypeValue(tv zcode.Bytes) string

func IDChar ¶

func IDChar(c rune) bool

func IsContainerType ¶

func IsContainerType(typ Type) bool

func IsFloat ¶

func IsFloat(id int) bool

True iff the type id is encoded as a float encoding. XXX add IDDecimal here when we implement coercible math with it.

func IsIdentifier ¶

func IsIdentifier(s string) bool

func IsInteger ¶

func IsInteger(id int) bool

True iff the type id is encoded as a zng signed or unsigened integer zcode.Bytes.

func IsMissing ¶

func IsMissing(zv Value) bool

func IsNumber ¶

func IsNumber(id int) bool

True iff the type id is encoded as a zng signed or unsigned integer zcode.Bytes, float32 zcode.Bytes, or float64 zcode.Bytes.

func IsPrimitiveType ¶

func IsPrimitiveType(typ Type) bool

func IsRecordType ¶

func IsRecordType(typ Type) bool

func IsSigned ¶

func IsSigned(id int) bool

True iff the type id is encoded as a number encoding and is signed.

func IsStringy ¶

func IsStringy(id int) bool

True iff the type id is encoded as a string zcode.Bytes.

func IsTrue ¶

func IsTrue(zv zcode.Bytes) bool

func IsTypeName ¶

func IsTypeName(s string) bool

IsTypeName returns true iff s is a valid zson typedef name (exclusive of integer names for locally-scoped typedefs).

func IsUnionType ¶

func IsUnionType(typ Type) bool

func NormalizeMap ¶

func NormalizeMap(zv zcode.Bytes) zcode.Bytes

NormalizeMap interprets zv as a map body and returns an equivalent map body that is normalized according to the ZNG specification (i.e., the tag-counted value of each entry's key is lexicographically greater than that of the preceding entry).

func NormalizeSet ¶

func NormalizeSet(zv zcode.Bytes) zcode.Bytes

NormalizeSet interprets zv as a set body and returns an equivalent set body that is normalized according to the ZNG specification (i.e., each element's tag-counted value is lexicographically greater than that of the preceding element).

func PromoteInt ¶

func PromoteInt(aid, bid int) int

Promote type to the largest signed type where the IDs must both satisfy IsNumber.

func QuotedName ¶

func QuotedName(name string) string

func QuotedString ¶

func QuotedString(data []byte, bstr bool) string

func TypeChar ¶

func TypeChar(c rune) bool

func TypeID ¶

func TypeID(typ Type) int

func UnescapeBstring ¶

func UnescapeBstring(data []byte) []byte

UnescapeBstring replaces all the escaped characters defined in the for the zng spec for the bstring type with their unescaped equivalents.

func Unhex ¶

func Unhex(b byte) byte

func Walk ¶

func Walk(typ Type, body zcode.Bytes, visit Visitor) error

Types ¶

type Builder ¶

type Builder struct {
	zcode.Builder
	Type *TypeRecord
}

Builder provides a way of easily and efficiently building records of the same type.

func NewBuilder ¶

func NewBuilder(typ *TypeRecord) *Builder

func (*Builder) Build ¶

func (b *Builder) Build(zvs ...zcode.Bytes) *Value

Build encodes the top-level zcode.Bytes values as the Bytes field of a record and sets that field and the Type field of the passed-in record. XXX This currently only works for zvals that are properly formatted for the top-level scan of the record, e.g., if a field is record[id:[record:[orig_h:ip]] then the zval passed in here for that field must have the proper encoding... this works fine when values are extracted and inserted from the proper level but when leaf values are inserted we should have another method to handle this, e.g., by encoding the dfs traversal of the record type with info about primitive vs container insertions. This could be the start of a whole package that provides different ways to build Records via, e.g., a marshal API, auto-generated stubs, etc.

type Column ¶

type Column struct {
	Name string
	Type Type
}

Column defines the field name and type of a column in a record type.

func NewColumn ¶

func NewColumn(name string, typ Type) Column

type ColumnBuilder ¶

type ColumnBuilder struct {
	// contains filtered or unexported fields
}

func NewColumnBuilder ¶

func NewColumnBuilder(zctx *Context, fields field.List) (*ColumnBuilder, error)

NewColumnBuilder constructs the zcode.Bytes representation for columns built from an array of input field selectors expressed as field.Path. Append should be called to enter field values in the left to right order of the provided fields and Encode is called to retrieve the nested zcode.Bytes value. Reset should be called before encoding the next record.

func (*ColumnBuilder) Append ¶

func (c *ColumnBuilder) Append(leaf []byte, container bool)

func (*ColumnBuilder) Encode ¶

func (c *ColumnBuilder) Encode() (zcode.Bytes, error)

func (*ColumnBuilder) Reset ¶

func (c *ColumnBuilder) Reset()

func (*ColumnBuilder) TypedColumns ¶

func (c *ColumnBuilder) TypedColumns(types []Type) []Column

A ColumnBuilder understands the shape of a sequence of FieldExprs (i.e., which columns are inside nested records) but not the types. TypedColumns takes an array of Types for the individual fields and constructs an array of Columns that reflects the fullly typed structure. This is suitable for e.g. allocating a descriptor.

type CompressionFormat ¶

type CompressionFormat int
const CompressionFormatLZ4 CompressionFormat = 0x00

type Context ¶

type Context struct {
	// contains filtered or unexported fields
}

A Context implements the "type context" in the Zed model. For a given set of related Values, each Value has a type from a shared Context. The Context manages the transitive closure of Types so that each unique type corresponds to exactly one Type pointer allowing type equivlance to be determined by pointer comparison. (Type pointers from distinct Contexts obviously do not have this property.) A Context also provides an efficient means to translate type values (represented as serialized ZNG) to Types. This provides an efficient means to translate Type pointers from one context to another.

func NewContext ¶

func NewContext() *Context

func (*Context) AddColumns ¶

func (c *Context) AddColumns(r *Value, newCols []Column, vals []Value) (*Value, error)

AddColumns returns a new Record with columns equal to the given record along with new rightmost columns as indicated with the given values. If any of the newly provided columns already exists in the specified value, an error is returned.

func (*Context) Lookup ¶

func (c *Context) Lookup(id int) *TypeRecord

func (*Context) LookupByValue ¶

func (c *Context) LookupByValue(tv zcode.Bytes) (Type, error)

LookupByValue returns the Type indicated by a binary-serialized type value. This provides a means to translate a type-context-independent serialized encoding for an arbitrary type into the reciever Context.

func (*Context) LookupType ¶

func (c *Context) LookupType(id int) (Type, error)

func (*Context) LookupTypeAlias ¶

func (c *Context) LookupTypeAlias(name string, target Type) (*TypeAlias, error)

func (*Context) LookupTypeArray ¶

func (c *Context) LookupTypeArray(inner Type) *TypeArray

func (*Context) LookupTypeDef ¶

func (c *Context) LookupTypeDef(name string) *TypeAlias

func (*Context) LookupTypeEnum ¶

func (c *Context) LookupTypeEnum(symbols []string) *TypeEnum

func (*Context) LookupTypeMap ¶

func (c *Context) LookupTypeMap(keyType, valType Type) *TypeMap

func (*Context) LookupTypeRecord ¶

func (c *Context) LookupTypeRecord(columns []Column) (*TypeRecord, error)

LookupTypeRecord returns a TypeRecord within this context that binds with the indicated columns. Subsequent calls with the same columns will return the same record pointer. If the type doesn't exist, it's created, stored, and returned. The closure of types within the columns must all be from this type context. If you want to use columns from a different type context, use TranslateTypeRecord.

func (*Context) LookupTypeSet ¶

func (c *Context) LookupTypeSet(inner Type) *TypeSet

func (*Context) LookupTypeUnion ¶

func (c *Context) LookupTypeUnion(types []Type) *TypeUnion

func (*Context) LookupTypeValue ¶

func (c *Context) LookupTypeValue(typ Type) Value

func (*Context) MustLookupTypeRecord ¶

func (c *Context) MustLookupTypeRecord(columns []Column) *TypeRecord

func (*Context) Reset ¶

func (c *Context) Reset()

func (*Context) TranslateType ¶

func (c *Context) TranslateType(ext Type) (Type, error)

TranslateType takes a type from another context and creates and returns that type in this context.

func (*Context) TranslateTypeRecord ¶

func (t *Context) TranslateTypeRecord(ext *TypeRecord) (*TypeRecord, error)

type Mapper ¶

type Mapper struct {
	// contains filtered or unexported fields
}

func NewMapper ¶

func NewMapper(out *Context) *Mapper

func (*Mapper) Enter ¶

func (m *Mapper) Enter(id int, ext Type) (Type, error)

func (*Mapper) EnterType ¶

func (m *Mapper) EnterType(td int, typ Type)

func (*Mapper) Lookup ¶

func (m *Mapper) Lookup(td int) Type

Lookup tranlates Zed types by type ID from one context to another. The first context is implied by the argument to Lookup() and the output type context is explicitly determined by the argument to NewMapper(). If a binding has not yet been entered, nil is returned and Enter() should be called to create the binding. There is a race here when two threads attempt to update the same ID, but it is safe because the outputContext will return the same the pointer so the second update does not change anything.

type RecordTypeError ¶

type RecordTypeError struct {
	Name string
	Type string
	Err  error
}

func (*RecordTypeError) Error ¶

func (r *RecordTypeError) Error() string

func (*RecordTypeError) Unwrap ¶

func (r *RecordTypeError) Unwrap() error

type Type ¶

type Type interface {
	Marshal(zcode.Bytes) (interface{}, error)
	// ID returns a unique (per Context) identifier that
	// represents this type.  For an aliased type, this identifier
	// represents the actual underlying type and not the alias itself.
	// Callers that care about the underlying type of a Value for
	// example should prefer to use this instead of using the go
	// .(type) operator on a Type instance.
	ID() int
	String() string
	Format(zv zcode.Bytes) string
}

A Type is an interface presented by a zeek type. Types can be used to infer type compatibility and create new values of the underlying type.

func AliasOf ¶

func AliasOf(typ Type) Type

func InnerType ¶

func InnerType(typ Type) Type

InnerType returns the element type for the underlying set or array type or nil if the underlying type is not a set or array.

func LookupPrimitive ¶

func LookupPrimitive(name string) Type

func LookupPrimitiveByID ¶

func LookupPrimitiveByID(id int) Type

type TypeAlias ¶

type TypeAlias struct {
	Name string
	Type Type
	// contains filtered or unexported fields
}

func NewTypeAlias ¶

func NewTypeAlias(id int, name string, typ Type) *TypeAlias

func (*TypeAlias) AliasID ¶

func (t *TypeAlias) AliasID() int

func (*TypeAlias) Format ¶

func (t *TypeAlias) Format(zv zcode.Bytes) string

func (*TypeAlias) ID ¶

func (t *TypeAlias) ID() int

func (*TypeAlias) Marshal ¶

func (t *TypeAlias) Marshal(zv zcode.Bytes) (interface{}, error)

func (*TypeAlias) String ¶

func (t *TypeAlias) String() string

type TypeArray ¶

type TypeArray struct {
	Type Type
	// contains filtered or unexported fields
}

func NewTypeArray ¶

func NewTypeArray(id int, typ Type) *TypeArray

func (*TypeArray) Format ¶

func (t *TypeArray) Format(zv zcode.Bytes) string

func (*TypeArray) ID ¶

func (t *TypeArray) ID() int

func (*TypeArray) Marshal ¶

func (t *TypeArray) Marshal(zv zcode.Bytes) (interface{}, error)

func (*TypeArray) String ¶

func (t *TypeArray) String() string

type TypeEnum ¶

type TypeEnum struct {
	Symbols []string
	// contains filtered or unexported fields
}

func NewTypeEnum ¶

func NewTypeEnum(id int, symbols []string) *TypeEnum

func (*TypeEnum) Format ¶

func (t *TypeEnum) Format(zv zcode.Bytes) string

func (*TypeEnum) ID ¶

func (t *TypeEnum) ID() int

func (*TypeEnum) Lookup ¶

func (t *TypeEnum) Lookup(symbol string) int

func (*TypeEnum) Marshal ¶

func (t *TypeEnum) Marshal(zv zcode.Bytes) (interface{}, error)

func (*TypeEnum) String ¶

func (t *TypeEnum) String() string

func (*TypeEnum) Symbol ¶

func (t *TypeEnum) Symbol(index int) (string, error)

type TypeMap ¶

type TypeMap struct {
	KeyType Type
	ValType Type
	// contains filtered or unexported fields
}

func NewTypeMap ¶

func NewTypeMap(id int, keyType, valType Type) *TypeMap

func (*TypeMap) Decode ¶

func (t *TypeMap) Decode(zv zcode.Bytes) (Value, Value, error)

func (*TypeMap) Format ¶

func (t *TypeMap) Format(zv zcode.Bytes) string

func (*TypeMap) ID ¶

func (t *TypeMap) ID() int

func (*TypeMap) Marshal ¶

func (t *TypeMap) Marshal(zv zcode.Bytes) (interface{}, error)

func (*TypeMap) String ¶

func (t *TypeMap) String() string

type TypeOfBool ¶

type TypeOfBool struct{}

func (*TypeOfBool) Format ¶

func (t *TypeOfBool) Format(zv zcode.Bytes) string

func (*TypeOfBool) ID ¶

func (t *TypeOfBool) ID() int

func (*TypeOfBool) Marshal ¶

func (t *TypeOfBool) Marshal(zv zcode.Bytes) (interface{}, error)

func (*TypeOfBool) String ¶

func (t *TypeOfBool) String() string

type TypeOfBstring ¶

type TypeOfBstring struct{}

func (*TypeOfBstring) Format ¶

func (t *TypeOfBstring) Format(data zcode.Bytes) string

Values of type bstring may contain a mix of valid UTF-8 and arbitrary binary data. These are represented in output using the same formatting with "\x.." escapes as Zeek. In general, valid UTF-8 code points are passed through unmodified, though for the ZEEK_ASCII output format, all non-ascii bytes are escaped for compatibility with older versions of Zeek.

func (*TypeOfBstring) ID ¶

func (t *TypeOfBstring) ID() int

func (*TypeOfBstring) Marshal ¶

func (t *TypeOfBstring) Marshal(zv zcode.Bytes) (interface{}, error)

func (*TypeOfBstring) String ¶

func (t *TypeOfBstring) String() string

type TypeOfBytes ¶

type TypeOfBytes struct{}

func (*TypeOfBytes) Format ¶

func (t *TypeOfBytes) Format(zv zcode.Bytes) string

func (*TypeOfBytes) ID ¶

func (t *TypeOfBytes) ID() int

func (*TypeOfBytes) Marshal ¶

func (t *TypeOfBytes) Marshal(zv zcode.Bytes) (interface{}, error)

func (*TypeOfBytes) String ¶

func (t *TypeOfBytes) String() string

type TypeOfDuration ¶

type TypeOfDuration struct{}

func (*TypeOfDuration) Format ¶

func (t *TypeOfDuration) Format(zv zcode.Bytes) string

func (*TypeOfDuration) ID ¶

func (t *TypeOfDuration) ID() int

func (*TypeOfDuration) Marshal ¶

func (t *TypeOfDuration) Marshal(zv zcode.Bytes) (interface{}, error)

func (*TypeOfDuration) String ¶

func (t *TypeOfDuration) String() string

type TypeOfError ¶

type TypeOfError struct{}

func (*TypeOfError) Format ¶

func (t *TypeOfError) Format(zv zcode.Bytes) string

func (*TypeOfError) ID ¶

func (t *TypeOfError) ID() int

func (*TypeOfError) Marshal ¶

func (t *TypeOfError) Marshal(zv zcode.Bytes) (interface{}, error)

func (*TypeOfError) String ¶

func (t *TypeOfError) String() string

type TypeOfFloat32 ¶

type TypeOfFloat32 struct{}

func (*TypeOfFloat32) Format ¶

func (t *TypeOfFloat32) Format(zb zcode.Bytes) string

func (*TypeOfFloat32) ID ¶

func (t *TypeOfFloat32) ID() int

func (*TypeOfFloat32) Marshal ¶

func (t *TypeOfFloat32) Marshal(zb zcode.Bytes) (interface{}, error)

func (*TypeOfFloat32) String ¶

func (t *TypeOfFloat32) String() string

type TypeOfFloat64 ¶

type TypeOfFloat64 struct{}

func (*TypeOfFloat64) Format ¶

func (t *TypeOfFloat64) Format(zv zcode.Bytes) string

func (*TypeOfFloat64) ID ¶

func (t *TypeOfFloat64) ID() int

func (*TypeOfFloat64) Marshal ¶

func (t *TypeOfFloat64) Marshal(zv zcode.Bytes) (interface{}, error)

func (*TypeOfFloat64) String ¶

func (t *TypeOfFloat64) String() string

type TypeOfIP ¶

type TypeOfIP struct{}

func (*TypeOfIP) Format ¶

func (t *TypeOfIP) Format(zv zcode.Bytes) string

func (*TypeOfIP) ID ¶

func (t *TypeOfIP) ID() int

func (*TypeOfIP) Marshal ¶

func (t *TypeOfIP) Marshal(zv zcode.Bytes) (interface{}, error)

func (*TypeOfIP) String ¶

func (t *TypeOfIP) String() string

type TypeOfInt16 ¶

type TypeOfInt16 struct{}

func (*TypeOfInt16) Format ¶

func (t *TypeOfInt16) Format(zv zcode.Bytes) string

func (*TypeOfInt16) ID ¶

func (t *TypeOfInt16) ID() int

func (*TypeOfInt16) Marshal ¶

func (t *TypeOfInt16) Marshal(zv zcode.Bytes) (interface{}, error)

func (*TypeOfInt16) String ¶

func (t *TypeOfInt16) String() string

type TypeOfInt32 ¶

type TypeOfInt32 struct{}

func (*TypeOfInt32) Format ¶

func (t *TypeOfInt32) Format(zv zcode.Bytes) string

func (*TypeOfInt32) ID ¶

func (t *TypeOfInt32) ID() int

func (*TypeOfInt32) Marshal ¶

func (t *TypeOfInt32) Marshal(zv zcode.Bytes) (interface{}, error)

func (*TypeOfInt32) String ¶

func (t *TypeOfInt32) String() string

type TypeOfInt64 ¶

type TypeOfInt64 struct{}

func (*TypeOfInt64) Format ¶

func (t *TypeOfInt64) Format(zv zcode.Bytes) string

func (*TypeOfInt64) ID ¶

func (t *TypeOfInt64) ID() int

func (*TypeOfInt64) Marshal ¶

func (t *TypeOfInt64) Marshal(zv zcode.Bytes) (interface{}, error)

func (*TypeOfInt64) String ¶

func (t *TypeOfInt64) String() string

type TypeOfInt8 ¶

type TypeOfInt8 struct{}

func (*TypeOfInt8) Format ¶

func (t *TypeOfInt8) Format(zv zcode.Bytes) string

func (*TypeOfInt8) ID ¶

func (t *TypeOfInt8) ID() int

func (*TypeOfInt8) Marshal ¶

func (t *TypeOfInt8) Marshal(zv zcode.Bytes) (interface{}, error)

func (*TypeOfInt8) String ¶

func (t *TypeOfInt8) String() string

type TypeOfNet ¶

type TypeOfNet struct{}

func (*TypeOfNet) Format ¶

func (t *TypeOfNet) Format(zv zcode.Bytes) string

func (*TypeOfNet) ID ¶

func (t *TypeOfNet) ID() int

func (*TypeOfNet) Marshal ¶

func (t *TypeOfNet) Marshal(zv zcode.Bytes) (interface{}, error)

func (*TypeOfNet) String ¶

func (t *TypeOfNet) String() string

type TypeOfNull ¶

type TypeOfNull struct{}

func (*TypeOfNull) Format ¶

func (t *TypeOfNull) Format(zv zcode.Bytes) string

func (*TypeOfNull) ID ¶

func (t *TypeOfNull) ID() int

func (*TypeOfNull) Marshal ¶

func (t *TypeOfNull) Marshal(zv zcode.Bytes) (interface{}, error)

func (*TypeOfNull) String ¶

func (t *TypeOfNull) String() string

type TypeOfString ¶

type TypeOfString struct{}

func (*TypeOfString) Format ¶

func (t *TypeOfString) Format(zv zcode.Bytes) string

func (*TypeOfString) ID ¶

func (t *TypeOfString) ID() int

func (*TypeOfString) Marshal ¶

func (t *TypeOfString) Marshal(zv zcode.Bytes) (interface{}, error)

func (*TypeOfString) String ¶

func (t *TypeOfString) String() string

type TypeOfTime ¶

type TypeOfTime struct{}

func (*TypeOfTime) Format ¶

func (t *TypeOfTime) Format(zv zcode.Bytes) string

func (*TypeOfTime) ID ¶

func (t *TypeOfTime) ID() int

func (*TypeOfTime) Marshal ¶

func (t *TypeOfTime) Marshal(zv zcode.Bytes) (interface{}, error)

func (*TypeOfTime) String ¶

func (t *TypeOfTime) String() string

type TypeOfType ¶

type TypeOfType struct{}

func (*TypeOfType) Format ¶

func (t *TypeOfType) Format(zv zcode.Bytes) string

func (*TypeOfType) ID ¶

func (t *TypeOfType) ID() int

func (*TypeOfType) Marshal ¶

func (t *TypeOfType) Marshal(zv zcode.Bytes) (interface{}, error)

func (*TypeOfType) String ¶

func (t *TypeOfType) String() string

type TypeOfUint16 ¶

type TypeOfUint16 struct{}

func (*TypeOfUint16) Format ¶

func (t *TypeOfUint16) Format(zv zcode.Bytes) string

func (*TypeOfUint16) ID ¶

func (t *TypeOfUint16) ID() int

func (*TypeOfUint16) Marshal ¶

func (t *TypeOfUint16) Marshal(zv zcode.Bytes) (interface{}, error)

func (*TypeOfUint16) String ¶

func (t *TypeOfUint16) String() string

type TypeOfUint32 ¶

type TypeOfUint32 struct{}

func (*TypeOfUint32) Format ¶

func (t *TypeOfUint32) Format(zv zcode.Bytes) string

func (*TypeOfUint32) ID ¶

func (t *TypeOfUint32) ID() int

func (*TypeOfUint32) Marshal ¶

func (t *TypeOfUint32) Marshal(zv zcode.Bytes) (interface{}, error)

func (*TypeOfUint32) String ¶

func (t *TypeOfUint32) String() string

type TypeOfUint64 ¶

type TypeOfUint64 struct{}

func (*TypeOfUint64) Format ¶

func (t *TypeOfUint64) Format(zv zcode.Bytes) string

func (*TypeOfUint64) ID ¶

func (t *TypeOfUint64) ID() int

func (*TypeOfUint64) Marshal ¶

func (t *TypeOfUint64) Marshal(zv zcode.Bytes) (interface{}, error)

func (*TypeOfUint64) String ¶

func (t *TypeOfUint64) String() string

type TypeOfUint8 ¶

type TypeOfUint8 struct{}

func (*TypeOfUint8) Format ¶

func (t *TypeOfUint8) Format(zv zcode.Bytes) string

func (*TypeOfUint8) ID ¶

func (t *TypeOfUint8) ID() int

func (*TypeOfUint8) Marshal ¶

func (t *TypeOfUint8) Marshal(zv zcode.Bytes) (interface{}, error)

func (*TypeOfUint8) String ¶

func (t *TypeOfUint8) String() string

type TypeRecord ¶

type TypeRecord struct {
	Columns []Column
	LUT     map[string]int
	// contains filtered or unexported fields
}

func NewTypeRecord ¶

func NewTypeRecord(id int, columns []Column) *TypeRecord

func TypeRecordOf ¶

func TypeRecordOf(typ Type) *TypeRecord

func (*TypeRecord) ColumnOfField ¶

func (t *TypeRecord) ColumnOfField(field string) (int, bool)

func (*TypeRecord) Decode ¶

func (t *TypeRecord) Decode(zv zcode.Bytes) ([]Value, error)

XXX we shouldn't need this... tests are using it

func (*TypeRecord) Format ¶

func (t *TypeRecord) Format(zv zcode.Bytes) string

func (*TypeRecord) HasField ¶

func (t *TypeRecord) HasField(field string) bool

func (*TypeRecord) ID ¶

func (t *TypeRecord) ID() int

func (*TypeRecord) Marshal ¶

func (t *TypeRecord) Marshal(zv zcode.Bytes) (interface{}, error)

func (*TypeRecord) String ¶

func (t *TypeRecord) String() string

func (*TypeRecord) TypeOfField ¶

func (t *TypeRecord) TypeOfField(field string) (Type, bool)

type TypeSet ¶

type TypeSet struct {
	Type Type
	// contains filtered or unexported fields
}

func NewTypeSet ¶

func NewTypeSet(id int, typ Type) *TypeSet

func (*TypeSet) Format ¶

func (t *TypeSet) Format(zv zcode.Bytes) string

func (*TypeSet) ID ¶

func (t *TypeSet) ID() int

func (*TypeSet) Marshal ¶

func (t *TypeSet) Marshal(zv zcode.Bytes) (interface{}, error)

func (*TypeSet) String ¶

func (t *TypeSet) String() string

type TypeUnion ¶

type TypeUnion struct {
	Types []Type
	// contains filtered or unexported fields
}

func NewTypeUnion ¶

func NewTypeUnion(id int, types []Type) *TypeUnion

func (*TypeUnion) Format ¶

func (t *TypeUnion) Format(zv zcode.Bytes) string

func (*TypeUnion) ID ¶

func (t *TypeUnion) ID() int

func (*TypeUnion) Marshal ¶

func (t *TypeUnion) Marshal(zv zcode.Bytes) (interface{}, error)

func (*TypeUnion) SplitZng ¶

func (t *TypeUnion) SplitZng(zv zcode.Bytes) (Type, int64, zcode.Bytes, error)

SplitZng takes a zng encoding of a value of the receiver's union type and returns the concrete type of the value, its selector, and the value encoding.

func (*TypeUnion) String ¶

func (t *TypeUnion) String() string

func (*TypeUnion) Type ¶

func (t *TypeUnion) Type(selector int) (Type, error)

Type returns the type corresponding to selector.

type TypeVectorTable ¶

type TypeVectorTable struct {
	// contains filtered or unexported fields
}

func NewTypeVectorTable ¶

func NewTypeVectorTable() *TypeVectorTable

func (*TypeVectorTable) Length ¶

func (t *TypeVectorTable) Length() int

func (*TypeVectorTable) Lookup ¶

func (t *TypeVectorTable) Lookup(types []Type) int

func (*TypeVectorTable) LookupByValues ¶

func (t *TypeVectorTable) LookupByValues(vals []Value) int

func (*TypeVectorTable) Types ¶

func (t *TypeVectorTable) Types(id int) []Type

type Value ¶

type Value struct {
	Type  Type
	Bytes zcode.Bytes
}

func NewBool ¶

func NewBool(b bool) Value

func NewBstring ¶

func NewBstring(s string) Value

func NewBytes ¶

func NewBytes(b []byte) Value

func NewDuration ¶

func NewDuration(d nano.Duration) Value

func NewError ¶

func NewError(err error) Value

func NewErrorf ¶

func NewErrorf(format string, args ...interface{}) Value

func NewFloat32 ¶

func NewFloat32(f float32) Value

func NewFloat64 ¶

func NewFloat64(f float64) Value

func NewIP ¶

func NewIP(a net.IP) Value

func NewNet ¶

func NewNet(s *net.IPNet) Value

func NewString ¶

func NewString(s string) Value

func NewTime ¶

func NewTime(ts nano.Ts) Value

func NewTypeValue ¶

func NewTypeValue(t Type) Value

func NewUint64 ¶

func NewUint64(v uint64) Value

func NewValue ¶ added in v0.32.0

func NewValue(zt Type, zb zcode.Bytes) *Value

func Not ¶ added in v0.32.0

func Not(zb zcode.Bytes) Value

Not returns the inverse Value of the Boolean-typed bytes value of zb.

func Split ¶

func Split(elemType Type, b zcode.Bytes) ([]Value, error)

func (*Value) Access ¶ added in v0.32.0

func (r *Value) Access(field string) (Value, error)

func (*Value) AccessBool ¶ added in v0.32.0

func (r *Value) AccessBool(field string) (bool, error)

func (*Value) AccessIP ¶ added in v0.32.0

func (r *Value) AccessIP(field string) (net.IP, error)

func (*Value) AccessInt ¶ added in v0.32.0

func (r *Value) AccessInt(field string) (int64, error)

func (*Value) AccessString ¶ added in v0.32.0

func (r *Value) AccessString(field string) (string, error)

func (*Value) AccessTime ¶ added in v0.32.0

func (r *Value) AccessTime(field string) (nano.Ts, error)

func (*Value) AccessTimeByColumn ¶ added in v0.32.0

func (r *Value) AccessTimeByColumn(colno int) (nano.Ts, error)

func (Value) ArrayIndex ¶

func (v Value) ArrayIndex(idx int64) (Value, error)

If the passed-in element is an array, attempt to get the idx'th element, and return its type and raw representation. Returns an error if the passed-in element is not an array or if idx is outside the array bounds.

func (*Value) ColumnOfField ¶ added in v0.32.0

func (r *Value) ColumnOfField(field string) (int, bool)

func (*Value) Columns ¶ added in v0.32.0

func (r *Value) Columns() []Column

func (Value) ContainerLength ¶

func (v Value) ContainerLength() (int, error)

func (Value) Copy ¶

func (v Value) Copy() Value

func (*Value) CopyBytes ¶ added in v0.32.0

func (r *Value) CopyBytes()

func (*Value) Deref ¶ added in v0.32.0

func (r *Value) Deref(path field.Path) (Value, error)

func (Value) Elements ¶

func (v Value) Elements() ([]Value, error)

Elements returns an array of Values for the given container type. Returns an error if the element is not an array or set.

func (Value) Encode ¶

func (v Value) Encode(dst zcode.Bytes) zcode.Bytes

Encode appends the ZNG representation of this value to the passed in argument and returns the resulting zcode.Bytes (which may or may not be the same underlying buffer, as with append(), depending on its capacity)

func (Value) Equal ¶

func (v Value) Equal(p Value) bool

func (*Value) FieldIter ¶ added in v0.32.0

func (r *Value) FieldIter() fieldIter

FieldIter returns a fieldIter iterator over the receiver's values.

func (*Value) HasField ¶ added in v0.32.0

func (r *Value) HasField(field string) bool

func (Value) IsContainer ¶

func (v Value) IsContainer() bool

func (Value) IsError ¶

func (v Value) IsError() bool

func (Value) IsMissing ¶

func (v Value) IsMissing() bool

func (Value) IsNil ¶

func (v Value) IsNil() bool

func (Value) IsStringy ¶

func (v Value) IsStringy() bool

func (Value) IsUnset ¶

func (v Value) IsUnset() bool

IsUnset returns true iff v is an unset value. Unset values are represented with a zero-valued Value. A zero-valued value that is not unset is represented by a non-nil slice for Bytes of zero length.

func (Value) IsUnsetOrNil ¶

func (v Value) IsUnsetOrNil() bool

func (Value) Iter ¶

func (v Value) Iter() zcode.Iter

func (*Value) Keep ¶ added in v0.32.0

func (r *Value) Keep() *Value

func (Value) MarshalJSON ¶

func (v Value) MarshalJSON() ([]byte, error)

func (*Value) Slice ¶ added in v0.32.0

func (r *Value) Slice(column int) (zcode.Bytes, error)

Slice returns the encoded zcode.Bytes corresponding to the indicated column or an error if a problem was encountered. If the encoded bytes result is nil without error, then that columnn is unset in this record value.

func (Value) String ¶

func (v Value) String() string

String implements fmt.Stringer.String. It should only be used for logs, debugging, etc. Any caller that requires a specific output format should use FormatAs() instead.

func (*Value) TypeCheck ¶ added in v0.32.0

func (r *Value) TypeCheck() error

TypeCheck checks that the Bytes field is structurally consistent with this value's Type. It does not check that the actual leaf values when parsed are type compatible with the leaf types.

func (*Value) TypeOfColumn ¶ added in v0.32.0

func (r *Value) TypeOfColumn(col int) Type

func (*Value) ValueByColumn ¶ added in v0.32.0

func (r *Value) ValueByColumn(col int) Value

Value returns the indicated column as a Value. If the column doesn't exist or another error occurs, the nil Value is returned.

func (*Value) ValueByField ¶ added in v0.32.0

func (r *Value) ValueByField(field string) (Value, error)

func (*Value) Walk ¶ added in v0.32.0

func (r *Value) Walk(rv Visitor) error

Walk traverses a record in depth-first order, calling a RecordVisitor on the way.

type Visitor ¶

type Visitor func(typ Type, body zcode.Bytes) error

A Visitor is called for each value in a record encountered by Walk. If the visitor returns an error, the walk stops and that error will be returned to the caller of Walk(). The sole exception is when the visitor returns the special value SkipContainer.

Directories ¶

Path Synopsis
api
cli
cmd
zc
zed
zq
zst
ast
Package ast declares the types used to represent syntax trees for Zed queries.
Package ast declares the types used to represent syntax trees for Zed queries.
agg
Package index provides an API for creating, merging, indexing, and querying zed indexes.
Package index provides an API for creating, merging, indexing, and querying zed indexes.
api
Package mdtest finds example shell commands in Markdown files and runs them, checking for expected output and exit status.
Package mdtest finds example shell commands in Markdown files and runs them, checking for expected output and exit status.
pkg
bufwriter
Package bufwriter provides a wrapper for a io.WriteCloser that uses buffered output via a bufio.Writer and calls Flush on close.
Package bufwriter provides a wrapper for a io.WriteCloser that uses buffered output via a bufio.Writer and calls Flush on close.
byteconv
Package byteconv implements conversions from byte slice representations of various data types.
Package byteconv implements conversions from byte slice representations of various data types.
charm
Package charm is minimilast CLI framework inspired by cobra and urfave/cli.
Package charm is minimilast CLI framework inspired by cobra and urfave/cli.
colw
Package colw lays out columns for display of a list when you don't know ahead of time how many columns should exist.
Package colw lays out columns for display of a list when you don't know ahead of time how many columns should exist.
fs
glob
Package glob implements glob-style pattern matching
Package glob implements glob-style pattern matching
repl
Package repl is a simple read-eval-print loop.
Package repl is a simple read-eval-print loop.
rlimit
Package rlimit provides a single function, RaiseOpenFilesLimit.
Package rlimit provides a single function, RaiseOpenFilesLimit.
storage/cache
Package cache contains facilities for caching immutable files, typically for a cloud object store.
Package cache contains facilities for caching immutable files, typically for a cloud object store.
storage/mock
Package mock is a generated GoMock package.
Package mock is a generated GoMock package.
combine
A combine proc merges multiple upstream inputs into one output.
A combine proc merges multiple upstream inputs into one output.
mux
A mux proc merges multiple upstream inputs into one output like combine but labels each batch.
A mux proc merges multiple upstream inputs into one output like combine but labels each batch.
put
rename
rename renames one or more fields in a record.
rename renames one or more fields in a record.
top
Package zcode implements serialization and deserialzation for ZNG values.
Package zcode implements serialization and deserialzation for ZNG values.
zio
zngio
Package zngio provides an API for reading and writing zng values and directives in binary zng format.
Package zngio provides an API for reading and writing zng values and directives in binary zng format.
Package zqe provides a mechanism to create or wrap errors with information that will aid in reporting them to users and returning them to api callers.
Package zqe provides a mechanism to create or wrap errors with information that will aid in reporting them to users and returning them to api callers.
Package zson provides fundamental interfaces to the ZSON data format comprising Reader, Writer, Parser, and so forth.
Package zson provides fundamental interfaces to the ZSON data format comprising Reader, Writer, Parser, and so forth.
zst
Package zst implements reading and writing zst storage objects to and from zng row format.
Package zst implements reading and writing zst storage objects to and from zng row format.
column
Package column implements the organization of columns on storage for a zst columnar storage object.
Package column implements the organization of columns on storage for a zst columnar storage object.
Package ztest runs formulaic tests ("ztests") that can be (1) run in-process with the compiled-ini zq code base, (2) run as a sub-process using the zq executable build artifact, or (3) run as a bash script running a sequence of arbitrary shell commands invoking any of the build artifacts.
Package ztest runs formulaic tests ("ztests") that can be (1) run in-process with the compiled-ini zq code base, (2) run as a sub-process using the zq executable build artifact, or (3) run as a bash script running a sequence of arbitrary shell commands invoking any of the build artifacts.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL