Skip to content

resolve multi-type sets in zng spec and zq implementation #1220

@mccanne

Description

@mccanne

On another topic triggered by working on zst, I would like to figure out what we do with sets. They come from zeek and show up in the brim app, but we've only ever seen single-type sets and the spec currently says <ntypes> must be 1, in conflict with zeek's generality. e.g., I think you could declare
set[string,int]
in zeek then say
1 in [["foo",2],["bar",1]]
and this would be true (maybe). Certainly you could say
["foo",2] in [["foo",2],["bar",1]]

If we got rid of from the set typedef spec, then we could by future-proofed by knowing if we really had to someday map a zeek multi-typed set, we could do so with a type alias

#zeek_mset0=set[record[c0:type0,c1:type1,...]]

and the app could even hide the dummy column names in the UI because it knows it's funky type alias. And if you really put set[record[]] in the zng, then the UI could display as is. I'm guessing this will never need to be done so I like this approach. Specfically, the proposal is to simplify the set typedef encodinig by getting rid of the field...

https://github.com/brimsec/zq/blob/zst/zng/docs/spec.md#3113-set-typedef

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions