Skip to main content
Version: v3.0


A format specifies the encoding of data using two abstractions.

  1. Parser: a component that turns raw bytes into structured event data
  2. Printer: a component that turns structured events into raw bytes

Parsers and printers interact with their corresponding dual from a connector, as the diagram below shows:

The table below summarizes the parsers and printers that VAST currently supports:

ArrowApache Arrow IPC
ASCIITextual data representation
CEFCommon Event Format (CEF)
CSVComma-separated Values (CSV)
JSONNewline-delimited JSON (NDJSON)
NetFlowNetFlow v5, v9, and IPFIX
PCAPPacket handling via libpcap
SuricataSuricata EVE JSON
ZeekZeek TSV logs
nullA null sink discards all data
testRandom event generator

The list below covers all formats that VAST supports.