Skip to content

decompress_zstd

Decompresses a stream of bytes in the Zstd format.

decompress_zstd

The decompress_zstd operator decompresses bytes in a pipeline incrementally. The operator supports decompressing multiple concatenated streams of the same codec transparently.

Import Suricata events from a Zstd-compressed file

Section titled “Import Suricata events from a Zstd-compressed file”
load_file "eve.json.zstd"
decompress_zstd
read_suricata
import

compress_zstd, decompress_brotli, decompress_bz2, decompress_gzip, decompress_lz4