:tocdepth: 3 base/frameworks/broker/store.zeek ================================= .. zeek:namespace:: Broker The Broker-based data store API and its various options. :Namespace: Broker :Imports: :doc:`base/bif/data.bif.zeek `, :doc:`base/bif/store.bif.zeek `, :doc:`base/frameworks/broker/main.zeek ` Summary ~~~~~~~ Redefinable Options ################### ==================================================================================================== ========================================================================== :zeek:id:`Broker::default_clone_mutation_buffer_interval`: :zeek:type:`interval` :zeek:attr:`&redef` The maximum amount of time that a disconnected clone will buffer data store mutation commands. :zeek:id:`Broker::default_clone_resync_interval`: :zeek:type:`interval` :zeek:attr:`&redef` The default frequency at which clones will attempt to reconnect/resynchronize with their master in the event that they become disconnected. :zeek:id:`Broker::default_clone_stale_interval`: :zeek:type:`interval` :zeek:attr:`&redef` The duration after which a clone that is disconnected from its master will begin to treat its local cache as stale. :zeek:id:`Broker::table_store_db_directory`: :zeek:type:`string` :zeek:attr:`&redef` The directory used for storing persistent database files when using Broker store backed Zeek tables. :zeek:id:`Broker::table_store_master`: :zeek:type:`bool` :zeek:attr:`&redef` If set to true, the current node is the master node for Broker stores backing Zeek tables. ==================================================================================================== ========================================================================== Types ##### ========================================================= ============================================================= :zeek:type:`Broker::BackendOptions`: :zeek:type:`record` Options to tune the particular storage backends. :zeek:type:`Broker::BackendType`: :zeek:type:`enum` Enumerates the possible storage backends. :zeek:type:`Broker::QueryResult`: :zeek:type:`record` The result of a data store query. :zeek:type:`Broker::QueryStatus`: :zeek:type:`enum` Whether a data store query could be completed or not. :zeek:type:`Broker::SQLiteFailureMode`: :zeek:type:`enum` Behavior when the SQLite database file is found to be corrupt or otherwise fails to open or initialize. :zeek:type:`Broker::SQLiteJournalMode`: :zeek:type:`enum` Values supported for SQLite's PRAGMA journal_mode statement. :zeek:type:`Broker::SQLiteOptions`: :zeek:type:`record` Options to tune the SQLite storage backend. :zeek:type:`Broker::SQLiteSynchronous`: :zeek:type:`enum` Values supported for SQLite's PRAGMA synchronous statement. ========================================================= ============================================================= Functions ######### =============================================================== ============================================================================= :zeek:id:`Broker::append`: :zeek:type:`function` Extends an existing string with another. :zeek:id:`Broker::clear`: :zeek:type:`function` Deletes all of a store's content, it will be empty afterwards. :zeek:id:`Broker::close`: :zeek:type:`function` Close a data store. :zeek:id:`Broker::create_clone`: :zeek:type:`function` Create a clone of a master data store which may live with a remote peer. :zeek:id:`Broker::create_master`: :zeek:type:`function` Create a master data store which contains key-value pairs. :zeek:id:`Broker::data`: :zeek:type:`function` Convert any Zeek value to communication data. :zeek:id:`Broker::data_type`: :zeek:type:`function` Retrieve the type of data associated with communication data. :zeek:id:`Broker::decrement`: :zeek:type:`function` Decrements an existing value by a given amount. :zeek:id:`Broker::erase`: :zeek:type:`function` Remove a key-value pair from the store. :zeek:id:`Broker::exists`: :zeek:type:`function` Check if a key exists in a data store. :zeek:id:`Broker::get`: :zeek:type:`function` Lookup the value associated with a key in a data store. :zeek:id:`Broker::get_index_from_value`: :zeek:type:`function` Retrieve a specific index from an existing container value. :zeek:id:`Broker::increment`: :zeek:type:`function` Increments an existing value by a given amount. :zeek:id:`Broker::insert_into_set`: :zeek:type:`function` Inserts an element into an existing set. :zeek:id:`Broker::insert_into_table`: :zeek:type:`function` Inserts an element into an existing table. :zeek:id:`Broker::is_closed`: :zeek:type:`function` Check if a store is closed or not. :zeek:id:`Broker::keys`: :zeek:type:`function` Returns a set with all of a store's keys. :zeek:id:`Broker::pop`: :zeek:type:`function` Removes the last element of an existing vector. :zeek:id:`Broker::push`: :zeek:type:`function` Appends an element to an existing vector. :zeek:id:`Broker::put`: :zeek:type:`function` Insert a key-value pair into the store. :zeek:id:`Broker::put_unique`: :zeek:type:`function` Insert a key-value pair into the store, but only if the key does not already exist. :zeek:id:`Broker::record_assign`: :zeek:type:`function` Replace a field in a record at a particular position. :zeek:id:`Broker::record_create`: :zeek:type:`function` Create communication data of type "record". :zeek:id:`Broker::record_iterator`: :zeek:type:`function` Create an iterator for a record. :zeek:id:`Broker::record_iterator_last`: :zeek:type:`function` Check if there are no more elements to iterate over. :zeek:id:`Broker::record_iterator_next`: :zeek:type:`function` Advance an iterator. :zeek:id:`Broker::record_iterator_value`: :zeek:type:`function` Retrieve the data at an iterator's current position. :zeek:id:`Broker::record_lookup`: :zeek:type:`function` Lookup a field in a record at a particular position. :zeek:id:`Broker::record_size`: :zeek:type:`function` Get the number of fields within a record. :zeek:id:`Broker::remove_from`: :zeek:type:`function` Removes an element from an existing set or table. :zeek:id:`Broker::set_clear`: :zeek:type:`function` Remove all elements within a set. :zeek:id:`Broker::set_contains`: :zeek:type:`function` Check if a set contains a particular element. :zeek:id:`Broker::set_create`: :zeek:type:`function` Create communication data of type "set". :zeek:id:`Broker::set_insert`: :zeek:type:`function` Insert an element into a set. :zeek:id:`Broker::set_iterator`: :zeek:type:`function` Create an iterator for a set. :zeek:id:`Broker::set_iterator_last`: :zeek:type:`function` Check if there are no more elements to iterate over. :zeek:id:`Broker::set_iterator_next`: :zeek:type:`function` Advance an iterator. :zeek:id:`Broker::set_iterator_value`: :zeek:type:`function` Retrieve the data at an iterator's current position. :zeek:id:`Broker::set_remove`: :zeek:type:`function` Remove an element from a set. :zeek:id:`Broker::set_size`: :zeek:type:`function` Get the number of elements within a set. :zeek:id:`Broker::store_name`: :zeek:type:`function` Get the name of a store. :zeek:id:`Broker::table_clear`: :zeek:type:`function` Remove all elements within a table. :zeek:id:`Broker::table_contains`: :zeek:type:`function` Check if a table contains a particular key. :zeek:id:`Broker::table_create`: :zeek:type:`function` Create communication data of type "table". :zeek:id:`Broker::table_insert`: :zeek:type:`function` Insert a key-value pair into a table. :zeek:id:`Broker::table_iterator`: :zeek:type:`function` Create an iterator for a table. :zeek:id:`Broker::table_iterator_last`: :zeek:type:`function` Check if there are no more elements to iterate over. :zeek:id:`Broker::table_iterator_next`: :zeek:type:`function` Advance an iterator. :zeek:id:`Broker::table_iterator_value`: :zeek:type:`function` Retrieve the data at an iterator's current position. :zeek:id:`Broker::table_lookup`: :zeek:type:`function` Retrieve a value from a table. :zeek:id:`Broker::table_remove`: :zeek:type:`function` Remove a key-value pair from a table. :zeek:id:`Broker::table_size`: :zeek:type:`function` Get the number of elements within a table. :zeek:id:`Broker::vector_clear`: :zeek:type:`function` Remove all elements within a vector. :zeek:id:`Broker::vector_create`: :zeek:type:`function` Create communication data of type "vector". :zeek:id:`Broker::vector_insert`: :zeek:type:`function` Insert an element into a vector at a particular position, possibly displacing existing elements (insertion always grows the size of the vector by one). :zeek:id:`Broker::vector_iterator`: :zeek:type:`function` Create an iterator for a vector. :zeek:id:`Broker::vector_iterator_last`: :zeek:type:`function` Check if there are no more elements to iterate over. :zeek:id:`Broker::vector_iterator_next`: :zeek:type:`function` Advance an iterator. :zeek:id:`Broker::vector_iterator_value`: :zeek:type:`function` Retrieve the data at an iterator's current position. :zeek:id:`Broker::vector_lookup`: :zeek:type:`function` Lookup an element in a vector at a particular position. :zeek:id:`Broker::vector_remove`: :zeek:type:`function` Remove an element from a vector at a particular position. :zeek:id:`Broker::vector_replace`: :zeek:type:`function` Replace an element in a vector at a particular position. :zeek:id:`Broker::vector_size`: :zeek:type:`function` Get the number of elements within a vector. =============================================================== ============================================================================= Detailed Interface ~~~~~~~~~~~~~~~~~~ Redefinable Options ################### .. zeek:id:: Broker::default_clone_mutation_buffer_interval :source-code: base/frameworks/broker/store.zeek 26 26 :Type: :zeek:type:`interval` :Attributes: :zeek:attr:`&redef` :Default: ``2.0 mins`` The maximum amount of time that a disconnected clone will buffer data store mutation commands. If the clone reconnects before this time, it will replay all stored commands. Note that this doesn't completely prevent the loss of store updates: all mutation messages are fire-and-forget and not explicitly acknowledged by the master. A negative/zero value indicates to never buffer commands. .. zeek:id:: Broker::default_clone_resync_interval :source-code: base/frameworks/broker/store.zeek 12 12 :Type: :zeek:type:`interval` :Attributes: :zeek:attr:`&redef` :Default: ``10.0 secs`` The default frequency at which clones will attempt to reconnect/resynchronize with their master in the event that they become disconnected. .. zeek:id:: Broker::default_clone_stale_interval :source-code: base/frameworks/broker/store.zeek 18 18 :Type: :zeek:type:`interval` :Attributes: :zeek:attr:`&redef` :Default: ``5.0 mins`` The duration after which a clone that is disconnected from its master will begin to treat its local cache as stale. In the stale state, queries to the cache will timeout. A negative value indicates that the local cache is never treated as stale. .. zeek:id:: Broker::table_store_db_directory :source-code: base/frameworks/broker/store.zeek 36 36 :Type: :zeek:type:`string` :Attributes: :zeek:attr:`&redef` :Default: ``"."`` The directory used for storing persistent database files when using Broker store backed Zeek tables. .. zeek:id:: Broker::table_store_master :source-code: base/frameworks/broker/store.zeek 32 32 :Type: :zeek:type:`bool` :Attributes: :zeek:attr:`&redef` :Default: ``T`` If set to true, the current node is the master node for Broker stores backing Zeek tables. By default this value will be automatically set to true in standalone mode, and on the manager node of a cluster. This value should not typically be changed manually. Types ##### .. zeek:type:: Broker::BackendOptions :source-code: base/frameworks/broker/store.zeek 119 121 :Type: :zeek:type:`record` sqlite: :zeek:type:`Broker::SQLiteOptions` :zeek:attr:`&default` = *[path=, synchronous=, journal_mode=, failure_mode=Broker::SQLITE_FAILURE_MODE_FAIL, integrity_check=F]* :zeek:attr:`&optional` Options to tune the particular storage backends. .. zeek:type:: Broker::BackendType :source-code: base/frameworks/broker/store.zeek 55 55 :Type: :zeek:type:`enum` .. zeek:enum:: Broker::MEMORY Broker::BackendType .. zeek:enum:: Broker::SQLITE Broker::BackendType Enumerates the possible storage backends. .. zeek:type:: Broker::QueryResult :source-code: base/frameworks/broker/store.zeek 45 52 :Type: :zeek:type:`record` status: :zeek:type:`Broker::QueryStatus` Whether the query completed or not. result: :zeek:type:`Broker::Data` The result of the query. Certain queries may use a particular data type (e.g. querying store size always returns a count, but a lookup may return various data types). The result of a data store query. .. zeek:type:: Broker::QueryStatus :source-code: base/frameworks/broker/store.zeek 39 43 :Type: :zeek:type:`enum` .. zeek:enum:: Broker::SUCCESS Broker::QueryStatus .. zeek:enum:: Broker::FAILURE Broker::QueryStatus Whether a data store query could be completed or not. .. zeek:type:: Broker::SQLiteFailureMode :source-code: base/frameworks/broker/store.zeek 62 66 :Type: :zeek:type:`enum` .. zeek:enum:: Broker::SQLITE_FAILURE_MODE_FAIL Broker::SQLiteFailureMode Fail during initialization. .. zeek:enum:: Broker::SQLITE_FAILURE_MODE_DELETE Broker::SQLiteFailureMode Attempt to delete the database file and retry. Behavior when the SQLite database file is found to be corrupt or otherwise fails to open or initialize. .. zeek:type:: Broker::SQLiteJournalMode :source-code: base/frameworks/broker/store.zeek 76 80 :Type: :zeek:type:`enum` .. zeek:enum:: Broker::SQLITE_JOURNAL_MODE_DELETE Broker::SQLiteJournalMode .. zeek:enum:: Broker::SQLITE_JOURNAL_MODE_WAL Broker::SQLiteJournalMode Values supported for SQLite's PRAGMA journal_mode statement. .. zeek:type:: Broker::SQLiteOptions :source-code: base/frameworks/broker/store.zeek 82 116 :Type: :zeek:type:`record` path: :zeek:type:`string` :zeek:attr:`&default` = ``""`` :zeek:attr:`&optional` File system path of the database. If left empty, will be derived from the name of the store, and use the '.sqlite' file suffix. synchronous: :zeek:type:`Broker::SQLiteSynchronous` :zeek:attr:`&optional` If set, runs the PRAGMA synchronous statement with the provided value after connecting to the SQLite database. See `SQLite's synchronous documentation `_ for more details around performance and data safety trade offs. journal_mode: :zeek:type:`Broker::SQLiteJournalMode` :zeek:attr:`&optional` If set, runs the PRAGMA journal_mode statement with the provided value after connecting to the SQLite database. See `SQLite's journal_mode documentation `_ for more details around performance, data safety trade offs and interaction with the PRAGMA synchronous statement. failure_mode: :zeek:type:`Broker::SQLiteFailureMode` :zeek:attr:`&default` = ``Broker::SQLITE_FAILURE_MODE_FAIL`` :zeek:attr:`&optional` What to do when the database is found corrupt during initialization. When set to SQLITE_FAILURE_MODE_DELETE, the old file is deleted to allow creation of a new and empty database. By default, an error is reported, the corrupt database file left in place and the data store is in a non-functional state. integrity_check: :zeek:type:`bool` :zeek:attr:`&default` = ``F`` :zeek:attr:`&optional` When true, run the PRAGMA integrity_check statement after opening the database and fail according to ``failure_mode``. PRAGMA integrity_check may take a non-negligible amount of time, so you are advised to experiment with the expected sizes of your databases if that is acceptable. Corrupted databases should be reliably detected when this setting is ``T``. Options to tune the SQLite storage backend. .. zeek:type:: Broker::SQLiteSynchronous :source-code: base/frameworks/broker/store.zeek 68 74 :Type: :zeek:type:`enum` .. zeek:enum:: Broker::SQLITE_SYNCHRONOUS_OFF Broker::SQLiteSynchronous .. zeek:enum:: Broker::SQLITE_SYNCHRONOUS_NORMAL Broker::SQLiteSynchronous .. zeek:enum:: Broker::SQLITE_SYNCHRONOUS_FULL Broker::SQLiteSynchronous .. zeek:enum:: Broker::SQLITE_SYNCHRONOUS_EXTRA Broker::SQLiteSynchronous Values supported for SQLite's PRAGMA synchronous statement. Functions ######### .. zeek:id:: Broker::append :source-code: base/frameworks/broker/store.zeek 853 856 :Type: :zeek:type:`function` (h: :zeek:type:`opaque` of Broker::Store, k: :zeek:type:`any`, s: :zeek:type:`string`, e: :zeek:type:`interval` :zeek:attr:`&default` = ``0 secs`` :zeek:attr:`&optional`) : :zeek:type:`bool` Extends an existing string with another. :param h: the handle of the store to modify. :param k: the key whose associated value is to be modified. The key must already exist. :param s: the string to append. :param e: the new expiration interval of the modified key. If null, the current expiration time isn't changed. :returns: false if the store handle was not valid. .. zeek:id:: Broker::clear :source-code: base/frameworks/broker/store.zeek 883 886 :Type: :zeek:type:`function` (h: :zeek:type:`opaque` of Broker::Store) : :zeek:type:`bool` Deletes all of a store's content, it will be empty afterwards. :returns: false if the store handle was not valid. .. zeek:id:: Broker::close :source-code: base/frameworks/broker/store.zeek 792 795 :Type: :zeek:type:`function` (h: :zeek:type:`opaque` of Broker::Store) : :zeek:type:`bool` Close a data store. :param h: a data store handle. :returns: true if store was valid and is now closed. The handle can no longer be used for data store operations. .. zeek:id:: Broker::create_clone :source-code: base/frameworks/broker/store.zeek 786 790 :Type: :zeek:type:`function` (name: :zeek:type:`string`, resync_interval: :zeek:type:`interval` :zeek:attr:`&default` = :zeek:see:`Broker::default_clone_resync_interval` :zeek:attr:`&optional`, stale_interval: :zeek:type:`interval` :zeek:attr:`&default` = :zeek:see:`Broker::default_clone_stale_interval` :zeek:attr:`&optional`, mutation_buffer_interval: :zeek:type:`interval` :zeek:attr:`&default` = :zeek:see:`Broker::default_clone_mutation_buffer_interval` :zeek:attr:`&optional`) : :zeek:type:`opaque` of Broker::Store Create a clone of a master data store which may live with a remote peer. A clone automatically synchronizes to the master by receiving modifications and applying them locally. Direct modifications are not possible, they must be sent through the master store, which then automatically broadcasts the changes out to clones. But queries may be made directly against the local cloned copy, which may be resolved quicker than reaching out to a remote master store. :param name: the unique name which identifies the master data store. :param resync_interval: the frequency at which a clone that is disconnected from its master attempts to reconnect with it. :param stale_interval: the duration after which a clone that is disconnected from its master will begin to treat its local cache as stale. In this state, queries to the clone will timeout. A negative value indicates that the local cache is never treated as stale. :param mutation_buffer_interval: the amount of time to buffer data store update messages once a clone detects its master is unavailable. If the clone reconnects before this time, it will replay all buffered commands. Note that this doesn't completely prevent the loss of store updates: all mutation messages are fire-and-forget and not explicitly acknowledged by the master. A negative/zero value indicates that commands never buffer. :returns: a handle to the data store for which a subsequent call to :zeek:see:`Broker::is_closed` will return true if the store could not be created/opened. .. zeek:id:: Broker::create_master :source-code: base/frameworks/broker/store.zeek 778 781 :Type: :zeek:type:`function` (name: :zeek:type:`string`, b: :zeek:type:`Broker::BackendType` :zeek:attr:`&default` = ``Broker::MEMORY`` :zeek:attr:`&optional`, options: :zeek:type:`Broker::BackendOptions` :zeek:attr:`&default` = *[sqlite=[path=, synchronous=, journal_mode=, failure_mode=Broker::SQLITE_FAILURE_MODE_FAIL, integrity_check=F]]* :zeek:attr:`&optional`) : :zeek:type:`opaque` of Broker::Store Create a master data store which contains key-value pairs. :param name: a unique name for the data store. :param b: the storage backend to use. :param options: tunes how some storage backends operate. :returns: a handle to the data store for which a subsequent call to :zeek:see:`Broker::is_closed` will return true if the store could not be created/opened. .. zeek:id:: Broker::data :source-code: base/frameworks/broker/store.zeek 893 896 :Type: :zeek:type:`function` (d: :zeek:type:`any`) : :zeek:type:`Broker::Data` Convert any Zeek value to communication data. .. note:: Normally you won't need to use this function as data conversion happens implicitly when passing Zeek values into Broker functions. :param d: any Zeek value to attempt to convert (not all types are supported). :returns: the converted communication data. If the supplied Zeek data type does not support conversion to communication data, the returned record's optional field will not be set. .. zeek:id:: Broker::data_type :source-code: base/frameworks/broker/store.zeek 888 891 :Type: :zeek:type:`function` (d: :zeek:type:`Broker::Data`) : :zeek:type:`Broker::DataType` Retrieve the type of data associated with communication data. :param d: the communication data. :returns: The data type associated with the communication data. Note that Broker represents records in the same way as vectors, so there is no "record" type. .. zeek:id:: Broker::decrement :source-code: base/frameworks/broker/store.zeek 848 851 :Type: :zeek:type:`function` (h: :zeek:type:`opaque` of Broker::Store, k: :zeek:type:`any`, a: :zeek:type:`any` :zeek:attr:`&default` = ``1`` :zeek:attr:`&optional`, e: :zeek:type:`interval` :zeek:attr:`&default` = ``0 secs`` :zeek:attr:`&optional`) : :zeek:type:`bool` Decrements an existing value by a given amount. This is supported for all numerical types, as well as for timestamps. :param h: the handle of the store to modify. :param k: the key whose associated value is to be modified. The key must already exist. :param amount: the amount to decrement the value by. :param e: the new expiration interval of the modified key. If null, the current expiration time isn't changed. :returns: false if the store handle was not valid. .. zeek:id:: Broker::erase :source-code: base/frameworks/broker/store.zeek 838 841 :Type: :zeek:type:`function` (h: :zeek:type:`opaque` of Broker::Store, k: :zeek:type:`any`) : :zeek:type:`bool` Remove a key-value pair from the store. :param h: the handle of the store to modify. :param k: the key to remove. :returns: false if the store handle was not valid. .. zeek:id:: Broker::exists :source-code: base/frameworks/broker/store.zeek 807 810 :Type: :zeek:type:`function` (h: :zeek:type:`opaque` of Broker::Store, k: :zeek:type:`any`) : :zeek:type:`Broker::QueryResult` Check if a key exists in a data store. :param h: the handle of the store to query. :param k: the key to lookup. :returns: True if the key exists in the data store. .. zeek:id:: Broker::get :source-code: base/frameworks/broker/store.zeek 812 815 :Type: :zeek:type:`function` (h: :zeek:type:`opaque` of Broker::Store, k: :zeek:type:`any`) : :zeek:type:`Broker::QueryResult` Lookup the value associated with a key in a data store. :param h: the handle of the store to query. :param k: the key to lookup. :returns: the result of the query. .. zeek:id:: Broker::get_index_from_value :source-code: base/frameworks/broker/store.zeek 823 826 :Type: :zeek:type:`function` (h: :zeek:type:`opaque` of Broker::Store, k: :zeek:type:`any`, i: :zeek:type:`any`) : :zeek:type:`Broker::QueryResult` Retrieve a specific index from an existing container value. This is supported for values of types set, table, and vector. :param h: the handle of the store to query. :param k: the key of the container value to lookup. :param i: the index to retrieve from the container value. :returns: For tables and vectors, the value at the given index, or failure if the index doesn't exist. For sets, a boolean indicating whether the index exists. Returns failure if the key does not exist at all. .. zeek:id:: Broker::increment :source-code: base/frameworks/broker/store.zeek 843 846 :Type: :zeek:type:`function` (h: :zeek:type:`opaque` of Broker::Store, k: :zeek:type:`any`, a: :zeek:type:`any` :zeek:attr:`&default` = ``1`` :zeek:attr:`&optional`, e: :zeek:type:`interval` :zeek:attr:`&default` = ``0 secs`` :zeek:attr:`&optional`) : :zeek:type:`bool` Increments an existing value by a given amount. This is supported for all numerical types, as well as for timestamps. :param h: the handle of the store to modify. :param k: the key whose associated value is to be modified. The key must already exist. :param a: the amount to increment the value by. :param e: the new expiration interval of the modified key. If null, the current expiration time isn't changed. :returns: false if the store handle was not valid. .. zeek:id:: Broker::insert_into_set :source-code: base/frameworks/broker/store.zeek 858 861 :Type: :zeek:type:`function` (h: :zeek:type:`opaque` of Broker::Store, k: :zeek:type:`any`, i: :zeek:type:`any`, e: :zeek:type:`interval` :zeek:attr:`&default` = ``0 secs`` :zeek:attr:`&optional`) : :zeek:type:`bool` Inserts an element into an existing set. :param h: the handle of the store to modify. :param k: the key whose associated value is to be modified. The key must already exist. :param i: the index to insert into the set. :param e: the new expiration interval of the modified key. If null, the current expiration time isn't changed. :returns: false if the store handle was not valid. .. zeek:id:: Broker::insert_into_table :source-code: base/frameworks/broker/store.zeek 863 866 :Type: :zeek:type:`function` (h: :zeek:type:`opaque` of Broker::Store, k: :zeek:type:`any`, i: :zeek:type:`any`, v: :zeek:type:`any`, e: :zeek:type:`interval` :zeek:attr:`&default` = ``0 secs`` :zeek:attr:`&optional`) : :zeek:type:`bool` Inserts an element into an existing table. :param h: the handle of the store to modify. :param k: the key whose associated value is to be modified. The key must already exist. :param i: the index to insert into the table :param v: the value to associate with the index. :param e: the new expiration interval of the modified key. If null, the current expiration time isn't changed. :returns: false if the store handle was not valid. .. zeek:id:: Broker::is_closed :source-code: base/frameworks/broker/store.zeek 797 800 :Type: :zeek:type:`function` (h: :zeek:type:`opaque` of Broker::Store) : :zeek:type:`bool` Check if a store is closed or not. :returns: true if the store is closed. .. zeek:id:: Broker::keys :source-code: base/frameworks/broker/store.zeek 828 831 :Type: :zeek:type:`function` (h: :zeek:type:`opaque` of Broker::Store) : :zeek:type:`Broker::QueryResult` Returns a set with all of a store's keys. The results reflect a snapshot in time that may diverge from reality soon afterwards. When accessing any of the element, it may no longer actually be there. The function is also expensive for large stores, as it copies the complete set. :returns: a set with the keys. If you expect the keys to be of non-uniform type, consider using :zeek:see:`Broker::set_iterator` to iterate over the result. .. zeek:id:: Broker::pop :source-code: base/frameworks/broker/store.zeek 878 881 :Type: :zeek:type:`function` (h: :zeek:type:`opaque` of Broker::Store, k: :zeek:type:`any`, e: :zeek:type:`interval` :zeek:attr:`&default` = ``0 secs`` :zeek:attr:`&optional`) : :zeek:type:`bool` Removes the last element of an existing vector. :param h: the handle of the store to modify. :param k: the key whose associated value is to be modified. The key must already exist. :param e: the new expiration interval of the modified key. If null, the current expiration time isn't changed. :returns: false if the store handle was not valid. .. zeek:id:: Broker::push :source-code: base/frameworks/broker/store.zeek 873 876 :Type: :zeek:type:`function` (h: :zeek:type:`opaque` of Broker::Store, k: :zeek:type:`any`, v: :zeek:type:`any`, e: :zeek:type:`interval` :zeek:attr:`&default` = ``0 secs`` :zeek:attr:`&optional`) : :zeek:type:`bool` Appends an element to an existing vector. :param h: the handle of the store to modify. :param k: the key whose associated value is to be modified. The key must already exist. :param b: the value to append to the vector. :param e: the new expiration interval of the modified key. If null, the current expiration time isn't changed. :returns: false if the store handle was not valid. .. zeek:id:: Broker::put :source-code: base/frameworks/broker/store.zeek 833 836 :Type: :zeek:type:`function` (h: :zeek:type:`opaque` of Broker::Store, k: :zeek:type:`any`, v: :zeek:type:`any`, e: :zeek:type:`interval` :zeek:attr:`&default` = ``0 secs`` :zeek:attr:`&optional`) : :zeek:type:`bool` Insert a key-value pair into the store. :param h: the handle of the store to modify. :param k: the key to insert. :param v: the value to insert. :param e: the expiration interval of the key-value pair. :returns: false if the store handle was not valid. .. zeek:id:: Broker::put_unique :source-code: base/frameworks/broker/store.zeek 818 821 :Type: :zeek:type:`function` (h: :zeek:type:`opaque` of Broker::Store, k: :zeek:type:`any`, v: :zeek:type:`any`, e: :zeek:type:`interval` :zeek:attr:`&default` = ``0 secs`` :zeek:attr:`&optional`) : :zeek:type:`Broker::QueryResult` Insert a key-value pair into the store, but only if the key does not already exist. :param h: the handle of the store to modify. :param k: the key to insert. :param v: the value to insert. :param e: the expiration interval of the key-value pair. :returns: the result of the query which is a boolean data value that is true if the insertion happened, or false if it was rejected due to the key already existing. .. zeek:id:: Broker::record_assign :source-code: base/frameworks/broker/store.zeek 1068 1071 :Type: :zeek:type:`function` (r: :zeek:type:`Broker::Data`, idx: :zeek:type:`count`, d: :zeek:type:`any`) : :zeek:type:`bool` Replace a field in a record at a particular position. :param r: the record to modify. :param d: the new field value to assign. :param idx: the index to replace. :returns: false if the index was larger than any valid index, else true. .. zeek:id:: Broker::record_create :source-code: base/frameworks/broker/store.zeek 1058 1061 :Type: :zeek:type:`function` (sz: :zeek:type:`count`) : :zeek:type:`Broker::Data` Create communication data of type "record". :param sz: the number of fields in the record. :returns: record data, with all fields uninitialized. .. zeek:id:: Broker::record_iterator :source-code: base/frameworks/broker/store.zeek 1078 1081 :Type: :zeek:type:`function` (r: :zeek:type:`Broker::Data`) : :zeek:type:`opaque` of Broker::RecordIterator Create an iterator for a record. Note that this makes a copy of the record internally to ensure the iterator is always valid. :param r: the record to iterate over. :returns: an iterator. .. zeek:id:: Broker::record_iterator_last :source-code: base/frameworks/broker/store.zeek 1083 1086 :Type: :zeek:type:`function` (it: :zeek:type:`opaque` of Broker::RecordIterator) : :zeek:type:`bool` Check if there are no more elements to iterate over. :param it: an iterator. :returns: true if there are no more elements to iterator over, i.e. the iterator is one-past-the-final-element. .. zeek:id:: Broker::record_iterator_next :source-code: base/frameworks/broker/store.zeek 1088 1091 :Type: :zeek:type:`function` (it: :zeek:type:`opaque` of Broker::RecordIterator) : :zeek:type:`bool` Advance an iterator. :param it: an iterator. :returns: true if the iterator, after advancing, still references an element in the collection. False if the iterator, after advancing, is one-past-the-final-element. .. zeek:id:: Broker::record_iterator_value :source-code: base/frameworks/broker/store.zeek 1093 1096 :Type: :zeek:type:`function` (it: :zeek:type:`opaque` of Broker::RecordIterator) : :zeek:type:`Broker::Data` Retrieve the data at an iterator's current position. :param it: an iterator. :returns: element in the collection that the iterator currently references. .. zeek:id:: Broker::record_lookup :source-code: base/frameworks/broker/store.zeek 1073 1076 :Type: :zeek:type:`function` (r: :zeek:type:`Broker::Data`, idx: :zeek:type:`count`) : :zeek:type:`Broker::Data` Lookup a field in a record at a particular position. :param r: the record to query. :param idx: the index to lookup. :returns: the value at the index. The optional field of the returned record may not be set if the field of the record has no value or if the index was not valid. .. zeek:id:: Broker::record_size :source-code: base/frameworks/broker/store.zeek 1063 1066 :Type: :zeek:type:`function` (r: :zeek:type:`Broker::Data`) : :zeek:type:`count` Get the number of fields within a record. :param r: the record to query. :returns: the number of fields in the record. .. zeek:id:: Broker::remove_from :source-code: base/frameworks/broker/store.zeek 868 871 :Type: :zeek:type:`function` (h: :zeek:type:`opaque` of Broker::Store, k: :zeek:type:`any`, i: :zeek:type:`any`, e: :zeek:type:`interval` :zeek:attr:`&default` = ``0 secs`` :zeek:attr:`&optional`) : :zeek:type:`bool` Removes an element from an existing set or table. :param h: the handle of the store to modify. :param k: the key whose associated value is to be modified. The key must already exist. :param i: the index to remove from the set or table. :param e: the new expiration interval of the modified key. If null, the current expiration time isn't changed. :returns: false if the store handle was not valid. .. zeek:id:: Broker::set_clear :source-code: base/frameworks/broker/store.zeek 903 906 :Type: :zeek:type:`function` (s: :zeek:type:`Broker::Data`) : :zeek:type:`bool` Remove all elements within a set. :param s: the set to clear. :returns: always true. .. zeek:id:: Broker::set_contains :source-code: base/frameworks/broker/store.zeek 913 916 :Type: :zeek:type:`function` (s: :zeek:type:`Broker::Data`, key: :zeek:type:`any`) : :zeek:type:`bool` Check if a set contains a particular element. :param s: the set to query. :param key: the element to check for existence. :returns: true if the key exists in the set. .. zeek:id:: Broker::set_create :source-code: base/frameworks/broker/store.zeek 898 901 :Type: :zeek:type:`function` () : :zeek:type:`Broker::Data` Create communication data of type "set". .. zeek:id:: Broker::set_insert :source-code: base/frameworks/broker/store.zeek 918 921 :Type: :zeek:type:`function` (s: :zeek:type:`Broker::Data`, key: :zeek:type:`any`) : :zeek:type:`bool` Insert an element into a set. :param s: the set to modify. :param key: the element to insert. :returns: true if the key was inserted, or false if it already existed. .. zeek:id:: Broker::set_iterator :source-code: base/frameworks/broker/store.zeek 928 931 :Type: :zeek:type:`function` (s: :zeek:type:`Broker::Data`) : :zeek:type:`opaque` of Broker::SetIterator Create an iterator for a set. Note that this makes a copy of the set internally to ensure the iterator is always valid. :param s: the set to iterate over. :returns: an iterator. .. zeek:id:: Broker::set_iterator_last :source-code: base/frameworks/broker/store.zeek 933 936 :Type: :zeek:type:`function` (it: :zeek:type:`opaque` of Broker::SetIterator) : :zeek:type:`bool` Check if there are no more elements to iterate over. :param it: an iterator. :returns: true if there are no more elements to iterator over, i.e. the iterator is one-past-the-final-element. .. zeek:id:: Broker::set_iterator_next :source-code: base/frameworks/broker/store.zeek 938 941 :Type: :zeek:type:`function` (it: :zeek:type:`opaque` of Broker::SetIterator) : :zeek:type:`bool` Advance an iterator. :param it: an iterator. :returns: true if the iterator, after advancing, still references an element in the collection. False if the iterator, after advancing, is one-past-the-final-element. .. zeek:id:: Broker::set_iterator_value :source-code: base/frameworks/broker/store.zeek 943 946 :Type: :zeek:type:`function` (it: :zeek:type:`opaque` of Broker::SetIterator) : :zeek:type:`Broker::Data` Retrieve the data at an iterator's current position. :param it: an iterator. :returns: element in the collection that the iterator currently references. .. zeek:id:: Broker::set_remove :source-code: base/frameworks/broker/store.zeek 923 926 :Type: :zeek:type:`function` (s: :zeek:type:`Broker::Data`, key: :zeek:type:`any`) : :zeek:type:`bool` Remove an element from a set. :param s: the set to modify. :param key: the element to remove. :returns: true if the element existed in the set and is now removed. .. zeek:id:: Broker::set_size :source-code: base/frameworks/broker/store.zeek 908 911 :Type: :zeek:type:`function` (s: :zeek:type:`Broker::Data`) : :zeek:type:`count` Get the number of elements within a set. :param s: the set to query. :returns: the number of elements in the set. .. zeek:id:: Broker::store_name :source-code: base/frameworks/broker/store.zeek 802 805 :Type: :zeek:type:`function` (h: :zeek:type:`opaque` of Broker::Store) : :zeek:type:`string` Get the name of a store. :returns: the name of the store. .. zeek:id:: Broker::table_clear :source-code: base/frameworks/broker/store.zeek 953 956 :Type: :zeek:type:`function` (t: :zeek:type:`Broker::Data`) : :zeek:type:`bool` Remove all elements within a table. :param t: the table to clear. :returns: always true. .. zeek:id:: Broker::table_contains :source-code: base/frameworks/broker/store.zeek 963 966 :Type: :zeek:type:`function` (t: :zeek:type:`Broker::Data`, key: :zeek:type:`any`) : :zeek:type:`bool` Check if a table contains a particular key. :param t: the table to query. :param key: the key to check for existence. :returns: true if the key exists in the table. .. zeek:id:: Broker::table_create :source-code: base/frameworks/broker/store.zeek 948 951 :Type: :zeek:type:`function` () : :zeek:type:`Broker::Data` Create communication data of type "table". .. zeek:id:: Broker::table_insert :source-code: base/frameworks/broker/store.zeek 968 971 :Type: :zeek:type:`function` (t: :zeek:type:`Broker::Data`, key: :zeek:type:`any`, val: :zeek:type:`any`) : :zeek:type:`Broker::Data` Insert a key-value pair into a table. :param t: the table to modify. :param key: the key at which to insert the value. :param val: the value to insert. :returns: true if the key-value pair was inserted, or false if the key already existed in the table. .. zeek:id:: Broker::table_iterator :source-code: base/frameworks/broker/store.zeek 983 986 :Type: :zeek:type:`function` (t: :zeek:type:`Broker::Data`) : :zeek:type:`opaque` of Broker::TableIterator Create an iterator for a table. Note that this makes a copy of the table internally to ensure the iterator is always valid. :param t: the table to iterate over. :returns: an iterator. .. zeek:id:: Broker::table_iterator_last :source-code: base/frameworks/broker/store.zeek 988 991 :Type: :zeek:type:`function` (it: :zeek:type:`opaque` of Broker::TableIterator) : :zeek:type:`bool` Check if there are no more elements to iterate over. :param it: an iterator. :returns: true if there are no more elements to iterator over, i.e. the iterator is one-past-the-final-element. .. zeek:id:: Broker::table_iterator_next :source-code: base/frameworks/broker/store.zeek 993 996 :Type: :zeek:type:`function` (it: :zeek:type:`opaque` of Broker::TableIterator) : :zeek:type:`bool` Advance an iterator. :param it: an iterator. :returns: true if the iterator, after advancing, still references an element in the collection. False if the iterator, after advancing, is one-past-the-final-element. .. zeek:id:: Broker::table_iterator_value :source-code: base/frameworks/broker/store.zeek 998 1001 :Type: :zeek:type:`function` (it: :zeek:type:`opaque` of Broker::TableIterator) : :zeek:type:`Broker::TableItem` Retrieve the data at an iterator's current position. :param it: an iterator. :returns: element in the collection that the iterator currently references. .. zeek:id:: Broker::table_lookup :source-code: base/frameworks/broker/store.zeek 978 981 :Type: :zeek:type:`function` (t: :zeek:type:`Broker::Data`, key: :zeek:type:`any`) : :zeek:type:`Broker::Data` Retrieve a value from a table. :param t: the table to query. :param key: the key to lookup. :returns: the value associated with the key. If the key did not exist, then the optional field of the returned record is not set. .. zeek:id:: Broker::table_remove :source-code: base/frameworks/broker/store.zeek 973 976 :Type: :zeek:type:`function` (t: :zeek:type:`Broker::Data`, key: :zeek:type:`any`) : :zeek:type:`Broker::Data` Remove a key-value pair from a table. :param t: the table to modify. :param key: the key to remove from the table. :returns: the value associated with the key. If the key did not exist, then the optional field of the returned record is not set. .. zeek:id:: Broker::table_size :source-code: base/frameworks/broker/store.zeek 958 961 :Type: :zeek:type:`function` (t: :zeek:type:`Broker::Data`) : :zeek:type:`count` Get the number of elements within a table. :param t: the table to query. :returns: the number of elements in the table. .. zeek:id:: Broker::vector_clear :source-code: base/frameworks/broker/store.zeek 1008 1011 :Type: :zeek:type:`function` (v: :zeek:type:`Broker::Data`) : :zeek:type:`bool` Remove all elements within a vector. :param v: the vector to clear. :returns: always true. .. zeek:id:: Broker::vector_create :source-code: base/frameworks/broker/store.zeek 1003 1006 :Type: :zeek:type:`function` () : :zeek:type:`Broker::Data` Create communication data of type "vector". .. zeek:id:: Broker::vector_insert :source-code: base/frameworks/broker/store.zeek 1018 1021 :Type: :zeek:type:`function` (v: :zeek:type:`Broker::Data`, idx: :zeek:type:`count`, d: :zeek:type:`any`) : :zeek:type:`bool` Insert an element into a vector at a particular position, possibly displacing existing elements (insertion always grows the size of the vector by one). :param v: the vector to modify. :param d: the element to insert. :param idx: the index at which to insert the data. If it is greater than the current size of the vector, the element is inserted at the end. :returns: always true. .. zeek:id:: Broker::vector_iterator :source-code: base/frameworks/broker/store.zeek 1038 1041 :Type: :zeek:type:`function` (v: :zeek:type:`Broker::Data`) : :zeek:type:`opaque` of Broker::VectorIterator Create an iterator for a vector. Note that this makes a copy of the vector internally to ensure the iterator is always valid. :param v: the vector to iterate over. :returns: an iterator. .. zeek:id:: Broker::vector_iterator_last :source-code: base/frameworks/broker/store.zeek 1043 1046 :Type: :zeek:type:`function` (it: :zeek:type:`opaque` of Broker::VectorIterator) : :zeek:type:`bool` Check if there are no more elements to iterate over. :param it: an iterator. :returns: true if there are no more elements to iterator over, i.e. the iterator is one-past-the-final-element. .. zeek:id:: Broker::vector_iterator_next :source-code: base/frameworks/broker/store.zeek 1048 1051 :Type: :zeek:type:`function` (it: :zeek:type:`opaque` of Broker::VectorIterator) : :zeek:type:`bool` Advance an iterator. :param it: an iterator. :returns: true if the iterator, after advancing, still references an element in the collection. False if the iterator, after advancing, is one-past-the-final-element. .. zeek:id:: Broker::vector_iterator_value :source-code: base/frameworks/broker/store.zeek 1053 1056 :Type: :zeek:type:`function` (it: :zeek:type:`opaque` of Broker::VectorIterator) : :zeek:type:`Broker::Data` Retrieve the data at an iterator's current position. :param it: an iterator. :returns: element in the collection that the iterator currently references. .. zeek:id:: Broker::vector_lookup :source-code: base/frameworks/broker/store.zeek 1033 1036 :Type: :zeek:type:`function` (v: :zeek:type:`Broker::Data`, idx: :zeek:type:`count`) : :zeek:type:`Broker::Data` Lookup an element in a vector at a particular position. :param v: the vector to query. :param idx: the index to lookup. :returns: the value at the index. If the index was larger than any valid index, the optional field of the returned record is not set. .. zeek:id:: Broker::vector_remove :source-code: base/frameworks/broker/store.zeek 1028 1031 :Type: :zeek:type:`function` (v: :zeek:type:`Broker::Data`, idx: :zeek:type:`count`) : :zeek:type:`Broker::Data` Remove an element from a vector at a particular position. :param v: the vector to modify. :param idx: the index to remove. :returns: the value that was just evicted. If the index was larger than any valid index, the optional field of the returned record is not set. .. zeek:id:: Broker::vector_replace :source-code: base/frameworks/broker/store.zeek 1023 1026 :Type: :zeek:type:`function` (v: :zeek:type:`Broker::Data`, idx: :zeek:type:`count`, d: :zeek:type:`any`) : :zeek:type:`Broker::Data` Replace an element in a vector at a particular position. :param v: the vector to modify. :param d: the element to insert. :param idx: the index to replace. :returns: the value that was just evicted. If the index was larger than any valid index, the optional field of the returned record is not set. .. zeek:id:: Broker::vector_size :source-code: base/frameworks/broker/store.zeek 1013 1016 :Type: :zeek:type:`function` (v: :zeek:type:`Broker::Data`) : :zeek:type:`count` Get the number of elements within a vector. :param v: the vector to query. :returns: the number of elements in the vector.