Connects to a remote ZeroMQ publisher and receives events.
from_zmq endpoint:string, [prefix=string, keep_prefix=bool, { … }]Description
Section titled “Description”Connects to the specified ZeroMQ endpoint as a SUB socket and receives
messages that match the configured subscription prefix.
Tenzir documents these operators for PUB/SUB-style use. ZeroMQ itself does not
have a first-class notion of a topic. Instead, the prefix option performs a
raw prefix match on the incoming message bytes, using ZeroMQ subscription
filtering at the socket.
When keep_prefix=false, the operator strips the matched prefix from the
message before running the nested pipeline. This lets you combine prefix-based
routing at the transport layer with regular read_* operators inside TQL.
If the connection fails, the operator retries with exponential backoff.
endpoint: string
Section titled “endpoint: string”The remote endpoint to connect to. This is typically a ZeroMQ endpoint such as
tcp://host:port, ipc://path, or inproc://name.
prefix = string (optional)
Section titled “prefix = string (optional)”A constant subscription prefix to install on the SUB socket.
The expression must evaluate to a string before the operator starts receiving messages. It cannot depend on event fields.
Defaults to the empty string, which subscribes to all messages.
keep_prefix = bool (optional)
Section titled “keep_prefix = bool (optional)”Whether to keep the matched prefix in the bytes that are passed to the nested pipeline.
Defaults to false.
{ … } (optional)
Section titled “{ … } (optional)”The pipeline to run for incoming message payloads. It receives bytes and must
produce events, for example { read_json } or { read_syslog }.
If you omit the nested pipeline, the operator emits one event per message with a
single field message containing the message payload as a blob.
Examples
Section titled “Examples”Connect to a publisher and parse JSON
Section titled “Connect to a publisher and parse JSON”from_zmq "tcp://collector.example.com:5555" { read_json}Subscribe to a prefixed stream
Section titled “Subscribe to a prefixed stream”from_zmq "tcp://collector.example.com:5555", prefix="alerts/" { read_ndjson}Keep the matched prefix
Section titled “Keep the matched prefix”from_zmq "tcp://collector.example.com:5555", prefix="syslog ", keep_prefix=true { read_syslog}