Skip to content

Commit 4398a0c

Browse files
committed
Add advanced writing records documentation
1 parent a3c69b3 commit 4398a0c

2 files changed

Lines changed: 65 additions & 0 deletions

File tree

docs/source/advanced/index.rst

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,3 +11,4 @@ Advanced
1111
/advanced/filesystems
1212
/advanced/plugins
1313
/advanced/record_descriptors
14+
/advanced/records

docs/source/advanced/records.rst

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
Working with Records
2+
====================
3+
4+
This section describes how to work with records. Records are the fundamental data structure in ``dissect`` and are
5+
used to describe forensic evidence and artefacts in a structured way. They can be read from and written to various
6+
sources and formats.
7+
8+
Writing Records with rdump
9+
--------------------------
10+
11+
The easiest way to write records is by using the :doc:`/tools/rdump` tool. It allows you to read records from any
12+
source, filter them, and write them to a new destination.
13+
14+
The output format is determined by the ``-w/--writer`` argument. You can specify a filename, and ``rdump`` will
15+
automatically detect the desired output format and compression based on the file extension.
16+
17+
For example, to write records to a gzip-compressed file, you can use:
18+
19+
.. code-block:: console
20+
21+
$ rdump <source> -w output.rec.gz
22+
23+
Writing Records with Python
24+
---------------------------
25+
26+
For more advanced use-cases, you can use the :class:`flow.record.RecordWriter` class in your own Python scripts. This
27+
gives you full control over how and where records are written.
28+
29+
The ``RecordWriter`` is best used as a context manager. It takes a URI as its main argument, which specifies the
30+
adapter and any options to use.
31+
32+
Here's an example of writing records to a JSON file:
33+
34+
.. code-block:: python
35+
36+
from flow.record import RecordWriter, Record
37+
38+
records = [
39+
Record(myfield="value1"),
40+
Record(myfield="value2"),
41+
]
42+
43+
with RecordWriter("jsonfile://output.json?indent=2") as writer:
44+
for record in records:
45+
writer.write(record)
46+
47+
Adapters
48+
--------
49+
50+
The ``RecordWriter`` uses adapters to write to different formats. The adapter is selected based on the scheme of the
51+
URI passed to the ``RecordWriter``.
52+
53+
Some common adapters include:
54+
55+
* ``file``: The default record stream format.
56+
* ``csvfile``: For writing CSV files.
57+
* ``jsonfile``: For writing JSON or JSONL files.
58+
* ``line``: For writing to the console in a human-readable format.
59+
60+
You can get a full list of available adapters by running ``rdump --list-adapters``.
61+
62+
.. seealso::
63+
64+
For more information about the ``flow.record`` library, please refer to the :doc:`/projects/flow.record/index` page.

0 commit comments

Comments
 (0)