Log2t::output::serialize(3)

NAME
serialize - An output module that uses a simple JSON object to serialize the output.

DESCRIPTION
This output module of log2timeline takes the t_line timesetamp object and serializes it into a JSON object.

This makes the timestamp object saved in a 'native' object that can be loaded up by the tool and simple filtering done on the object itself.

  "get_version"
A simple subroutine that returns the version number of the format file

Returns:

A version number of the module.

  "new"
A simple constructor of the output module. Takes care of parsing parameters sent to the output module

  "get_description"
A simple subroutine that returns a string containing a description of the funcionality of the format file. This string is used when a list of all available format files is printed out

Returns:

A string containing a description of the format file's functionality.

  "print_header"
A simple sub routine that prints out a header. Since this serialied object does not require any header information this sub routine does not really do anything.

Returns:

Returns 1 if successful (which this sub routine always does).

  "get_footer"
This simple sub routine is called to get a footer of the format. This is done so that modules can append data to the output if wanted.

However, since this sub routine does not contain any footer it will not return anym, insteead it returns a 0, indicating there is no footer to be found.

Returns:

0 if no footer is there, otherwise a string cointaining the footer.

  <print_footer>
A simple sub routine that is called after all lines have been printed, this is called so that the module can print a footer.

Since this module does not contain any footer it simply returns straight away.

Returns:

A 1 indicating a success.

  "print_line"
This routine gets sent a t_line or a timestamp object and stores it in a serialized JSON object.

To make it easier to sort and do other filtering the output module splits up the timestamp object into one object per timesstamp.

This increases space taken on hard drive, yet at the same time makes output processing and sorting simpler.

Args:

t_line: A timestamp object, which is a reference to a hash that stores all the event information.

  "_copy_hash"
This sub routine is created to strip the timestamp out of a timestamp object.

Since we would like to serialize the timestamp as a single timestamp per entry, instead of the default behaviour of possibly storing up to 8 timestamps, this routine copies the timestamp object into a new reference to a hash, leaving the timestamps not copied.

That way the main routine can spawn copies of that new timestamp object and save the values of all the timestamps stored in the original one, thus creating a single timestamp object per timestamp.

Args:

t_line: A timestamp object that should be copied to a new value. This is a reference to a hash.

Returns:

A copy of the hash, or a reference to that hash, which is an exact replica of the original timestamp object without the timestamps associated to it.

  "get_help"
A simple subroutine that returns a string containing the help message for this particular output module.

Returns:

A string containing a help file for this format file

SEE ALSO
log2timeline Log2Timeline