X10 DividendLog Samples
Suricata
Suricata EVE JSON flow event.
Source: EVE JSON output. Newline-delimited JSON. Nested objects repeat the key on every record at every level, which is why this is the largest reduction measured.
Flow event
{
"timestamp": "2003-12-16T13:21:45.037333+0000",
"flow_id": 1332028388187153,
"event_type": "flow",
"flow": {
"pkts_toserver": 5,
"pkts_toclient": 4,
"bytes_toserver": 338,
"bytes_toclient": 272,
"start": "2003-12-16T13:21:44.891921+0000",
"end": "2003-12-16T13:21:45.346457+0000",
"age": 1,
"state": "closed",
"reason": "shutdown",
"alerted": true
},
"community_id": "1:LQU9qZlK+B5F3KDmev6m5PMibrg="
}The record carries three ISO-8601 timestamps — timestamp, flow.start, and
flow.end — at about 32 characters each. Epoch integers hold the same instants
in 10.
Suricata's published alert example elides fields with ..., so only the
complete flow event appears here.