Add event timestamp to python bindings.

zeek · Apr 19, 2023 · 0e68edc · 0e68edc
1 parent 3077d68
commit 0e68edc
Show file tree

Hide file tree

Showing 2 changed files with 18 additions and 5 deletions.
diff --git a/bindings/python/broker/zeek.py b/bindings/python/broker/zeek.py
@@ -7,13 +7,14 @@
 import broker
 
 class Event(_broker.zeek.Event):
-    def __init__(self, *args):
+    def __init__(self, *args, **kwargs):
         if len(args) == 1 and not isinstance(args[0], str):
             # Parse raw broker message as event.
             _broker.zeek.Event.__init__(self, broker.Data.from_py(args[0]))
         else:
-            # (name, arg1, arg2, ...)
-            _broker.zeek.Event.__init__(self, args[0], broker.Data.from_py(args[1:]))
+            # (name, arg1, arg2, ..., ts=0.0)
+            _broker.zeek.Event.__init__(self, args[0], kwargs.get("ts", 0.0),
+                broker.Data.from_py(args[1:]))
 
     def args(self):
         return [broker.Data.to_py(a) for a in _broker.zeek.Event.args(self)]

diff --git a/bindings/python/zeek.cpp b/bindings/python/zeek.cpp
@@ -27,9 +27,10 @@ void init_zeek(py::module& m) {
   py::class_<broker::zeek::Event, broker::zeek::Message>(m, "Event")
     .def(py::init(
       [](broker::data data) { return broker::zeek::Event(std::move(data)); }))
-    .def(py::init([](std::string name, broker::data args) {
+    .def(py::init([](std::string name, double ts, broker::data args) {
       return broker::zeek::Event(std::move(name),
-                                 std::move(broker::get<broker::vector>(args)));
+                                 std::move(broker::get<broker::vector>(args)),
+                                 ts);
     }))
     .def("valid",
          [](const broker::zeek::Event& ev) -> bool {
@@ -49,6 +50,17 @@ void init_zeek(py::module& m) {
            }
            return ev.name();
          })
+    .def("timestamp",
+         [](const broker::zeek::Event& ev) -> const double {
+           auto t = broker::zeek::Message::type(ev.as_data());
+           if (t != broker::zeek::Message::Type::Event) {
+             throw std::invalid_argument("invalid Event data/type");
+           }
+           if (!ev.valid()) {
+             throw std::invalid_argument("invalid Event data");
+           }
+           return ev.ts();
+         })
     .def("args", [](const broker::zeek::Event& ev) -> const broker::vector& {
       auto t = broker::zeek::Message::type(ev.as_data());
       if (t != broker::zeek::Message::Type::Event) {