The script
Outputs the line
to a log-file. This makes it impossible to distinguish a line containing EMPTY from a line containing an empty set.
Seth, do you want to try fixing this in conjunction w/ ? I think all that's needed is to modify the ASCII formatter to add an escape sequence for empty_field the same way it currently does for set_separator ?
Interestingly, the script included on this ticket now segfaults Bro. It looks like it's because it's reusing the SSH namespace and creating another SSH::LOG enum.
FWIW, what Jon commented last year is what needs to be done.