zek
Zeek event analyzer and scripting framework
TLDR
Generate a Go struct from a given XML from stdin and display output on stdout
Generate a Go struct from a given XML from stdin and send output to a file
Generate an example Go program from a given XML from stdin and send output to a file
SYNOPSIS
zek [options] pattern [file1 file2 ...]
PARAMETERS
-E, --extended-regexp
Interpret PATTERN as an extended regular expression (ERE).
-F, --fixed-strings
Interpret PATTERN as a list of fixed strings, separated by newlines, any of which is to be matched.
-G, --basic-regexp
Interpret PATTERN as a basic regular expression (BRE). This is the default.
-P, --perl-regexp
Interpret PATTERN as a Perl-compatible regular expression (PCRE).
-i, --ignore-case
Ignore case distinctions in both the PATTERN and the input files.
-v, --invert-match
Select non-matching lines.
-w, --word-regexp
Select only those lines containing matches that form whole words.
-x, --line-regexp
Select only those matches that exactly match the whole line.
-c, --count
Suppress normal output; instead print a count of matching lines for each input file. With the -v, --invert-match option (see below), count non-matching lines.
-l, --files-with-matches
Suppress normal output; instead print the name of each input file from which output would normally have been printed. The scanning will stop on the first match.
-h, --no-filename
Suppress the prefixing of filenames on output.
-H, --with-filename
Prefix each line of output with the name of the input file.
-n, --line-number
Prefix each line of output with the line number within its input file.
-s, --no-messages
Suppress error messages about nonexistent or unreadable files.
-o, --only-matching
Print only the matched (non-empty) parts of a matching line, with each such part on a separate output line.
-r, --recursive
Read all files under each directory, recursively; this is equivalent to the -d recurse option.
--help
Display a help message and exit.
--version
Output version information and exit.
file1 file2 ...
List of zstd compressed files to search. If no files are specified, the standard input is searched.
DESCRIPTION
The zek command is a utility for searching inside Zstandard (zstd) compressed files. It essentially acts as a wrapper around zgrep, allowing you to search for patterns within .zst files without needing to decompress them explicitly. This provides a significant performance advantage when searching through large compressed datasets. zek leverages the indexing capabilities of zgrep and inherits its options allowing for regular expression searches, case-insensitive matching, and other advanced pattern matching features. It's a valuable tool for analyzing compressed logs, archives, or any other zstd compressed data.
CAVEATS
zek depends on the zgrep utility being installed and available in the system's PATH. If zgrep is not installed, zek will not function correctly. Searching large files without proper indexing might be slow. Check and use zgrep indexing features, if possible.
EXIT STATUS
The exit status is 0 if selected lines are found, and 1 if not found. If an error occurred the exit status is 2.
HISTORY
zek is a relatively new addition to the zstd ecosystem, designed to simplify searching compressed data. Its development is driven by the need for efficient text searching within zstd archives without the overhead of decompression. Its usage is increasing with the wider adoption of zstd for compression.