def conn2neo(bulk, rec):
 query_cache = conn2neo.query_cache
 linkattrs = ('proto',)
 accumulators = {}
 if (rec['proto'] == 'icmp'):
  (rec['type'], rec['code']) = (rec.pop('id_orig_p'), rec.pop('id_resp_p'))
  accumulators = {'codes': ('{code}', None)}
  linkattrs = (linkattrs + ('type',))
 elif (('id_orig_p' in rec) and ('id_resp_p' in rec)):
  (rec['sport'], rec['dport']) = (rec.pop('id_orig_p'), rec.pop('id_resp_p'))
  accumulators = {'sports': ('{sport}', 5)}
  linkattrs = (linkattrs + ('dport',))
 counters = {'cspkts': '{orig_pkts}', 'csbytes': '{orig_ip_bytes}', 'scpkts': '{resp_pkts}', 'scbytes': '{resp_ip_bytes}'}
 if (linkattrs not in query_cache):
  query_cache[linkattrs] = db.flow.add_flow(['Flow'], linkattrs, counters=counters, accumulators=accumulators)
 bulk.append(query_cache[linkattrs], rec)

def conn2neo ( bulk , rec ) : query_cache = conn2neo . query_cache linkattrs = ( 'proto' , ) accumulators = { } if ( rec [ 'proto' ] == 'icmp' ) : ( rec [ 'type' ] , rec [ 'code' ] ) = ( rec . pop ( 'id_orig_p' ) , rec . pop ( 'id_resp_p' ) ) accumulators = { 'codes' : ( '{code}' , None ) } linkattrs = ( linkattrs + ( 'type' , ) ) elif ( ( 'id_orig_p' in rec ) and ( 'id_resp_p' in rec ) ) : ( rec [ 'sport' ] , rec [ 'dport' ] ) = ( rec . pop ( 'id_orig_p' ) , rec . pop ( 'id_resp_p' ) ) accumulators = { 'sports' : ( '{sport}' , 5 ) } linkattrs = ( linkattrs + ( 'dport' , ) ) counters = { 'cspkts' : '{orig_pkts}' , 'csbytes' : '{orig_ip_bytes}' , 'scpkts' : '{resp_pkts}' , 'scbytes' : '{resp_ip_bytes}' } if ( linkattrs not in query_cache ) : query_cache [ linkattrs ] = db . flow . add_flow ( [ 'Flow' ] , linkattrs , counters = counters , accumulators = accumulators ) bulk . append ( query_cache [ linkattrs ] , rec )
returns a statement inserting a conn flow from a bro log .