Add operator to package
package_add_operatorAdd user-defined TQL operators to a Tenzir package for reusable parsers, transformations, and OCSF mappings, with test scaffold generation and nested namespaces.
Instructions
Add a user-defined operator (UDO) to a package.
Use this tool to:
Add custom TQL operators to your package
Organize operators using nested namespaces (e.g., 'ocsf::logs::firewall')
Create parsers, transformations, or OCSF mappings as reusable operators
Automatically generate test scaffolds for new operators
Operators become available as package_id::operator_name in TQL pipelines after the package is installed.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| code | Yes | TQL code implementing the operator | |
| name | Yes | Name of the operator. Supports nested namespaces using '::' separator (e.g., 'parse', 'ocsf::logs::firewall') | |
| no_tests | No | Skip creating test scaffold for this operator | |
| description | Yes | Description of what the operator does | |
| package_dir | Yes | Path to the package directory |