add enabled_logs variable which can be redefed to limit the set of logs that gets JSON streaming logs created for it

[mmguero]

# Filter the list of files
redef JSONStreaming::enabled_logs = set("http","files");

This PR adds the ability to do the above. By default enabled_logs is an empty set, meaning "do all of the logs" (the current default behavior). But by setting enabled_logs to a set containing one or more log names (e.g., conn, http, dns, files, etc.) then only those json_streaming_ logs get created. The rest of the logic (for rotating, etc.) is untouched.

I also added testing/tests/logs-filtered.zeek to verify.

[ckreibich]

Just a question here Seth — are the individual filters really the granularity you're after? I ask because the parsing is a bit complex and your example of set("http","files") suggests so. If you're actually after log streams, not their attached filters, we could do

const JSONStreaming::enabled_logs: set[Log::ID] = set() &redef;

instead. Then the set could be e.g. set(HTTP::LOG, Files::LOG) etc, and we'd check higher up as we iterate over Log::active_streams.

[mmguero]

You're absolutely right. I'll adjust my PR next week after the holiday. Thanks for the review.

[mmguero]

@ckreibich Thanks for the suggestion I've updated the PR with this change.

[ckreibich]

Looks good to me, thanks Seth! Github has been unwilling to kick off that CI run for a whopping 8h now, so I'll hold out a little longer. 🤞

[ckreibich]

Hrrrm, looks like I no longer have maintainer access to the repo — I'd like to enable workflows for your PR. I'll need to ask around re. that one.

[ckreibich]

I just can't get Github to actually run this package's workflows. It tests fine over here locally, so I'll merge now. Thanks Seth!