broctl process trace.pcap test.bro gives:
I believe it's due to test.bro being placed in the middle of the command line that process builds. If I move it to the end, it works fine.
If you run "broctl process" with a custom script, then you need
to specify "--" so that broctl knows where the Bro options end
and where the custom scripts begin. So your example
broctl process trace.pcap – test.bro
Doing so moves test.bro farther down towards the end
of the Bro command line.
However, in this example we still get a different error,
because broctl adds its own script (process-trace.bro,
which contains a couple of redefs) at the very end of
the Bro command. I will change the order so that the
process-trace.bro is before the custom scripts (which
solves the syntax error).
In branch topic/dnthayer/ticket1124, I've changed the order of
scripts so that user-specified scripts are always at the end of
the Bro command, and I've improved the broctl help message
to show how the process command should be used.