Watching Directory Loader

[mavam]

In order to make it easy to continuously import data from files in a given directory, we would like to make it possible to "tail -f" all files in it. The desired UX would be along the lines of:

from file --tail /path/to/dir read json | ...

We can employ fswatch to implement this feature.

💯 Definition of Done

Tasks

Preview Give feedback

1. Define the operator UX
2. Implement it in the file connector
3. Test with Zeek's spool directory (by default $PREFIX/logs/current)
4. Test with a Suricata EVE log