Module emit 

Available on crate feature emit only.

flowscope::emit — structured event sinks.

Built-in writers for the three log formats every flow-analysis pipeline ends up emitting:

• FlowEventCsvWriter — flows.csv for spreadsheets, DuckDB, pandas. RFC-4180 quoting. No extra deps.
• FlowEventNdjsonWriter — newline-delimited JSON for Elasticsearch / Loki / ClickHouse. Gated on the emit-ndjson feature (pulls in serde_json and requires serde).
• ZeekConnLogWriter — Zeek-style conn.log rows (tab-separated). Drop-in for existing Zeek pipelines via zeek-cut.

Each writer takes a std::io::Write sink and a single FlowEvent<FiveTupleKey> per call. By default they emit only FlowEvent::Ended; use the per- writer options struct to opt into Started / Packet / anomaly rows.

use std::fs::File;
use std::io::BufWriter;
use flowscope::emit::FlowEventCsvWriter;
use flowscope::extract::FiveTuple;
use flowscope::pcap::PcapFlowSource;
use flowscope::FlowTracker;

let f = File::create("flows.csv")?;
let mut csv = FlowEventCsvWriter::new(BufWriter::new(f))?;
let mut tracker = FlowTracker::<FiveTuple>::new(FiveTuple::bidirectional());

for owned in PcapFlowSource::open("trace.pcap")?.views() {
    for ev in tracker.track(&owned?) {
        csv.write_event(&ev)?;
    }
}
for ev in tracker.finish() {
    csv.write_event(&ev)?;
}
csv.finish()?;

New in 0.10.0 (plan 101).

Structs

CsvOptions

Options for FlowEventCsvWriter.

EveJsonWriteremit-eve

Suricata EVE JSON writer. One JSON object per line.

EveOptionsemit-eve

Options for EveJsonWriter.

FlowEventCsvWriter

CSV writer for FlowEvent streams.

FlowEventNdjsonWriteremit-ndjson

Newline-delimited JSON writer for FlowEvent streams.

NdjsonOptionsemit-ndjson

Options for FlowEventNdjsonWriter.

ZeekConnLogWriter

Tab-separated Zeek conn.log writer for FlowEvent streams.

ZeekOptions

Options for ZeekConnLogWriter.

Traits

LifecycleEvent

A lifecycle event the emit writers can consume — implemented by both FlowEvent (the tracker primitive) and the typed driver’s Event (issue #97).