theopolis
Mike Myers
06/16/2020, 5:42 PMalessandrogario
data
column has been slightly changed; instead of adding the fields directly inside a single object (example: { "key": "value"}
), we now have a root "Data" object (example: { "Data": { "key": "value" } }
). This allows us to extend this with additional data from the Windows Event Log XML without breaking compatibilityseph
uint64_t
alessandrogario
seph
{data: {...}}
means you can add {metadata: {}}
or somethingalessandrogario
seph
alessandrogario
seph
launcher
tables, I’ve struggled a bit with this. For runtim e variable/unknown data fields, there’s no good translation to columns.
I don’t like dealing with json
data, it’s hard to merge/sort/join on it. I usually end up with an EAV model.alessandrogario
packetzero
06/18/2020, 3:49 PMalessandrogario
packetzero
06/18/2020, 4:44 PMalessandrogario
seph