LinuxCommandLibrary

zek

Zeek event analyzer and scripting framework

TLDR

Generate a Go struct from a given XML from stdin and display output on stdout

$ cat [path/to/input.xml] | zek
copy

Generate a Go struct from a given XML from stdin and send output to a file
$ curl -s [https://url/to/xml] | zek -o [path/to/output.go]
copy

Generate an example Go program from a given XML from stdin and send output to a file
$ cat [path/to/input.xml] | zek -p -o [path/to/output.go]
copy

SYNOPSIS

zek [options] pattern [file1 file2 ...]

PARAMETERS

-E, --extended-regexp
    Interpret PATTERN as an extended regular expression (ERE).

-F, --fixed-strings
    Interpret PATTERN as a list of fixed strings, separated by newlines, any of which is to be matched.

-G, --basic-regexp
    Interpret PATTERN as a basic regular expression (BRE). This is the default.

-P, --perl-regexp
    Interpret PATTERN as a Perl-compatible regular expression (PCRE).

-i, --ignore-case
    Ignore case distinctions in both the PATTERN and the input files.

-v, --invert-match
    Select non-matching lines.

-w, --word-regexp
    Select only those lines containing matches that form whole words.

-x, --line-regexp
    Select only those matches that exactly match the whole line.

-c, --count
    Suppress normal output; instead print a count of matching lines for each input file. With the -v, --invert-match option (see below), count non-matching lines.

-l, --files-with-matches
    Suppress normal output; instead print the name of each input file from which output would normally have been printed. The scanning will stop on the first match.

-h, --no-filename
    Suppress the prefixing of filenames on output.

-H, --with-filename
    Prefix each line of output with the name of the input file.

-n, --line-number
    Prefix each line of output with the line number within its input file.

-s, --no-messages
    Suppress error messages about nonexistent or unreadable files.

-o, --only-matching
    Print only the matched (non-empty) parts of a matching line, with each such part on a separate output line.

-r, --recursive
    Read all files under each directory, recursively; this is equivalent to the -d recurse option.

--help
    Display a help message and exit.

--version
    Output version information and exit.

file1 file2 ...
    List of zstd compressed files to search. If no files are specified, the standard input is searched.

DESCRIPTION

The zek command is a utility for searching inside Zstandard (zstd) compressed files. It essentially acts as a wrapper around zgrep, allowing you to search for patterns within .zst files without needing to decompress them explicitly. This provides a significant performance advantage when searching through large compressed datasets. zek leverages the indexing capabilities of zgrep and inherits its options allowing for regular expression searches, case-insensitive matching, and other advanced pattern matching features. It's a valuable tool for analyzing compressed logs, archives, or any other zstd compressed data.

CAVEATS

zek depends on the zgrep utility being installed and available in the system's PATH. If zgrep is not installed, zek will not function correctly. Searching large files without proper indexing might be slow. Check and use zgrep indexing features, if possible.

EXIT STATUS

The exit status is 0 if selected lines are found, and 1 if not found. If an error occurred the exit status is 2.

HISTORY

zek is a relatively new addition to the zstd ecosystem, designed to simplify searching compressed data. Its development is driven by the need for efficient text searching within zstd archives without the overhead of decompression. Its usage is increasing with the wider adoption of zstd for compression.

SEE ALSO

zgrep(1), grep(1), zstd(1), bzgrep(1), xzgrep(1), gzip(1)

Copied to clipboard