def _parse_bro_header(self, bro_log):
        """Parse the Bro log header section.

            Format example:
                #separator \x09
                #set_separator	,
                #empty_field	(empty)
                #unset_field	-
                #path	httpheader_recon
                #fields	ts	origin	useragent	header_events_json
                #types	time	string	string	string
        """

        # Open the Bro logfile
        with open(bro_log, 'r') as bro_file:

            # Skip until you find the #fields line
            _line = bro_file.readline()
            while not _line.startswith('#fields'):
                _line = bro_file.readline()

            # Read in the field names
            field_names = _line.strip().split(self._delimiter)[1:]

            # Read in the types
            _line = bro_file.readline()
            field_types = _line.strip().split(self._delimiter)[1:]

            # Setup the type converters
            type_converters = []
            for field_type in field_types:
                type_converters.append(self.type_mapper.get(field_type, self.type_mapper['unknown']))

            # Keep the header offset
            offset = bro_file.tell()

        # Return the header info
        return offset, field_names, field_types, type_converters
def _parse_bro_header ( self , bro_log ) : with open ( bro_log , 'r' ) as bro_file : _line = bro_file . readline ( ) while not _line . startswith ( '#fields' ) : _line = bro_file . readline ( ) field_names = _line . strip ( ) . split ( self . _delimiter ) [ 1 : ] _line = bro_file . readline ( ) field_types = _line . strip ( ) . split ( self . _delimiter ) [ 1 : ] type_converters = [ ] for field_type in field_types : type_converters . append ( self . type_mapper . get ( field_type , self . type_mapper [ 'unknown' ] ) ) offset = bro_file . tell ( ) return offset , field_names , field_types , type_converters
Parse the Bro log header section.

            Format example:
                #separator \x09
                #set_separator	,
                #empty_field	(empty)
                #unset_field	-
                #path	httpheader_recon
                #fields	ts	origin	useragent	header_events_json
                #types	time	string	string	string