WIP

libvast/src/system/pivot_command.cpp

@@ -65,6 +65,16 @@ make_writer(caf::actor_system& sys, const caf::settings& options) {
       return out.error();
     Writer writer{std::move(*out)};
     return sys.spawn(sink<Writer>, std::move(writer), max_events);
+  } else if constexpr (std::is_same_v<Writer, format::pcap::writer>) {
+#if VAST_HAVE_PCAP
+    auto output = get_or(options, category + ".write", defaults::write);
+    auto flush
+      = get_or(options, category + ".flush-interval", defaults::flush_interval);
+    Writer writer{output, flush};
+    return sys.spawn(sink<format::pcap::writer>, std::move(writer), max_events);
+#else
+    return make_error(ec::invalid_configuration, "pcap support unavailable");
+#endif
   } else {
     Writer writer;
     return sys.spawn(sink<Writer>, std::move(writer), max_events);
@@ -76,29 +86,19 @@ make_writer(caf::actor_system& sys, const caf::settings& options) {
 caf::message
 pivot_command(const command::invocation& invocation, caf::actor_system& sys) {
   VAST_TRACE(invocation);
+  // Read options and arguments.
+  auto format = caf::get_or(invocation.options, "pivot.format", "json");
+  const auto& target = invocation.arguments[0];
   // Read query from input file, STDIN or CLI arguments.
-  auto query = read_query(invocation, "export.read", size_t{1});
+  auto query = read_query(invocation, "pivot.read", 1u);
   if (!query)
     return caf::make_message(std::move(query.error()));
-  auto& options = invocation.options;
-  auto& target = invocation.arguments[0];
-  // using caf::get_or;
-  auto limit
-    = get_or(options, "export.max-events", defaults::export_::max_events);
   caf::actor writer;
   if (detail::starts_with(target, "pcap")) {
-#if VAST_HAVE_PCAP
-    using defaults_t = defaults::export_::pcap;
-    std::string category = defaults_t::category;
-    auto output = get_or(options, category + ".write", defaults_t::write);
-    auto flush = get_or(options, category + ".flush-interval",
-                        defaults_t::flush_interval);
-    format::pcap::writer w{output, flush};
-    writer = sys.spawn(sink<format::pcap::writer>, std::move(w), limit);
-#else
-    return make_message(make_error(ec::invalid_configuration, "pcap support "
-                                                              "unavailable"));
-#endif
+    auto w = make_writer<format::pcap::writer>(sys, invocation.options);
+    if (!w)
+      return make_message(w.error());
+    writer = *w;
   } else if (detail::starts_with(target, "suricata")) {
     auto w = make_writer<format::json::writer>(sys, invocation.options);
     if (!w)

libvast/src/system/spawn_pivoter.cpp

@@ -21,7 +21,7 @@
 namespace vast::system {
 
 maybe_actor spawn_pivoter(node_actor* self, spawn_arguments& args) {
-  VAST_DEBUG_ANON(VAST_ARG(args));
+  VAST_TRACE(VAST_ARG("node", self), VAST_ARG(args));
   auto& arguments = args.invocation.arguments;
   if (arguments.size() < 2)
     return unexpected_arguments(args);