Skip to content
Legacy docs for Tenzir v5.x. For the latest Tenzir v6 series, visit docs.tenzir.com. Migrating from v5? Read the Tenzir v6 migration guide.

Decompresses a stream of bytes in the Bzip2 format.

decompress_bz2

The decompress_bz2 operator decompresses bytes in a pipeline incrementally. The operator supports decompressing multiple concatenated streams of the same codec transparently.

Import Suricata events from a Bzip2-compressed file

Section titled “Import Suricata events from a Bzip2-compressed file”
load_file "eve.json.bz"
decompress_bz2
read_suricata
import

Last updated: