type "string" is not in union type "zenum=string|null

[philrz]

While I know Zeek data is not top of mind these days, I bumped into this error when trying to update some old test data and want to check that it's not a symptom of a broader issue. Input data http.log.gz is attached.

$ super -s http.log.gz | super -f bsup - > /dev/null
stdio:stdin: type "string" is not in union type "zenum=string|null"
write /dev/stdout: broken pipe

Details

Repro is with super commit cbb4109, which is associated with the changes in #6633.

I tried to narrow this down to a very minimal repro, but it seems to have something to do with handling a bunch of data at once. For instance, as I tried to trim back to minimal input, I hit this sweet spot where I could trigger a different error:

$ super -version
Version: v0.1.0-23-gcbb41094c

$ super -s http.log.gz | tail -35081 | super -f bsup - > /dev/null
stdio:stdin: record on line 8503: wrong number of fields

But one line more and we're on to the same error we saw when attempting to read the entire input.

$ super -s http.log.gz | tail -35082 | super -f bsup - > /dev/null
stdio:stdin: type "string" is not in union type "zenum=string|null"

This wasn't occurring at commit 1bced44 just prior to the merge of #6633.

$ super -version
Version: v0.1.0-22-g1bced4402

$ super -s http.log.gz | super -f bsup - > http.bsup
$ echo $?
0