get_version
new
get_description
print_header
get_footer
print_line
_copy_hash
get_help
serialize - An output module that uses a simple JSON object to serialize the output.
This output module of log2timeline takes the t_line timesetamp object and serializes it into a JSON object.
This makes the timestamp object saved in a 'native' object that can be loaded up by the tool and simple filtering done on the object itself.
get_version
A simple subroutine that returns the version number of the format file
new
A simple constructor of the output module. Takes care of parsing parameters sent to the output module
get_description
A simple subroutine that returns a string containing a description of the funcionality of the format file. This string is used when a list of all available format files is printed out
print_header
A simple sub routine that prints out a header. Since this serialied object does not require any header information this sub routine does not really do anything.
get_footer
This simple sub routine is called to get a footer of the format. This is done so that modules can append data to the output if wanted.
However, since this sub routine does not contain any footer it will not return anym, insteead it returns a 0, indicating there is no footer to be found.
A simple sub routine that is called after all lines have been printed, this is called so that the module can print a footer.
Since this module does not contain any footer it simply returns straight away.
print_line
This routine gets sent a t_line or a timestamp object and stores it in a serialized JSON object.
To make it easier to sort and do other filtering the output module splits up the timestamp object into one object per timesstamp.
This increases space taken on hard drive, yet at the same time makes output processing and sorting simpler.
_copy_hash
This sub routine is created to strip the timestamp out of a timestamp object.
Since we would like to serialize the timestamp as a single timestamp per entry, instead of the default behaviour of possibly storing up to 8 timestamps, this routine copies the timestamp object into a new reference to a hash, leaving the timestamps not copied.
That way the main routine can spawn copies of that new timestamp object and save the values of all the timestamps stored in the original one, thus creating a single timestamp object per timestamp.
get_help
A simple subroutine that returns a string containing the help message for this particular output module.
get_help()
{
return
"This output module takes the timestamp object and simply serializes
it using the JSON::XS module, so the timestamp object can be read again
later for processing.iThe module splits the timestamp object into a single object per timestamp to make filtering and sorting easier in the post-processing."; }
1;
__END__
log2timeline Log2Timeline