type "string" is not in union type "zenum=string|null

[philrz]

While I know Zeek data is not top of mind these days, I bumped into this error when trying to update some old test data and want to check that it's not a symptom of a broader issue. Input data http.log.gz is attached.

$ super -s http.log.gz | super -f bsup - > /dev/null
stdio:stdin: type "string" is not in union type "zenum=string|null"
write /dev/stdout: broken pipe

Details

Repro is with super commit cbb4109, which is associated with the changes in #6633.

I tried to narrow this down to a very minimal repro, but it seems to have something to do with handling a bunch of data at once. For instance, as I tried to trim back to minimal input, I hit this sweet spot where I could trigger a different error:

$ super -version
Version: v0.1.0-23-gcbb41094c

$ super -s http.log.gz | tail -35081 | super -f bsup - > /dev/null
stdio:stdin: record on line 8503: wrong number of fields

But one line more and we're on to the same error we saw when attempting to read the entire input.

$ super -s http.log.gz | tail -35082 | super -f bsup - > /dev/null
stdio:stdin: type "string" is not in union type "zenum=string|null"

This wasn't occurring at commit 1bced44 just prior to the merge of #6633.

$ super -version
Version: v0.1.0-22-g1bced4402

$ super -s http.log.gz | super -f bsup - > http.bsup
$ echo $?
0

[philrz]

Verified in super commit 53963be.

The changes in #6828 changed how named types are signaled in a SUP sequence, so it seemed likely to affect this issue, and sure enough the problem appears to be gone.

$ super -version
Version: v0.3.0-56-g53963bec1

$ super -s http.log.gz | super -f bsup - > /dev/null

$ echo $?
0

As the details #6828 describe, the zenum=... syntax in line with the data that had been an ingredient in triggering this error is gone and instead now leading type zenum =... syntax is used instead.

$ super -S http.log.gz | head -27
type port = uint16
type zenum = string
{
  _path: "http",
  ts: 2018-03-24T17:15:20.609736Z::(time|null),
  uid: "CWocsz4DZqCwMcqpI2"::(string|null),
  id: {
    orig_h: 10.164.94.120::(ip|null),
    orig_p: 36729::port::(port|null),
    resp_h: 10.47.3.200::(ip|null),
    resp_p: 80::port::(port|null)
  },
  trans_depth: 1::uint64::(uint64|null),
  method: "GET"::(string|null),
  host: "10.47.3.200"::(string|null),
  uri: "/chassis/config/GeneralChassisConfig.html"::(string|null),
  referrer: null::(string|null),
  version: "1.1"::(string|null),
  user_agent: "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)"::(string|null),
  origin: null::(string|null),
  request_body_len: 0::uint64::(uint64|null),
  response_body_len: 56::uint64::(uint64|null),
  status_code: 301::uint64::(uint64|null),
  status_msg: "Moved Permanently"::(string|null),
  info_code: null::(uint64|null),
  info_msg: null::(string|null),
  tags: set[]::set[zenum|null]::(null|set[zenum|null]),

Thanks @mccanne!