capture: reading pcap files directly from S3 about arkime HOT 7 CLOSED

Would reusing how auth works for the writer be ok, or do you expect something different?

from arkime.

You mean using the same S3 credentials? Yes!

I would expect the same behavior as importing a local pcap file.

If I use arkime-capture -r /some/path/to/file.pcap, I have seen that arkime uses the same filepath (= /some/path/to/file.pcap) in OpenSearch in the arkime-files index.

So I would expect that using arkime-capture -r s3://some/path/to/file.pcap, stores the same filepath (= s3://some/path/to/file.pcap) to s3 in arkime-files.

from arkime.

Ok, have the first version of this implemented, could you try out the latest commit build https://github.com/arkime/arkime/releases/tag/last-commit

you'll want to do either
capture -r s3://bucket/key.pcap
or
capture -r s3https://host:port/bucket/key.pcap

from arkime.

Hi @awick! Awesome!

I will try it out and will give feedback!

Can you point me to the commit which contains the change? I can't find it.

Thank you again!

from arkime.

I would suggest just using main

from arkime.

I meant, that #2571 implemented the feature.

from arkime.

ok, but there are updates since then, so I want to make sure you don't just use that

from arkime.