# Adding a human-readable timestamp field.

**URL:** <https://community.zeek.org/t/adding-a-human-readable-timestamp-field/2768>\
**Category:** Zeek\
**Created:** [August 7, 2013, 4:07pm UTC](https://community.zeek.org/t/adding-a-human-readable-timestamp-field/2768 "2013-08-07T16:07:03Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dani\_Witherspoon](https://avatars.discourse-cdn.com/v4/letter/d/5e9695/32.png) [@Dani\_Witherspoon](https://community.zeek.org/u/Dani_Witherspoon)\
**Post date:** [August 7, 2013, 4:07pm UTC](https://community.zeek.org/t/adding-a-human-readable-timestamp-field/2768/1 "2013-08-07T16:07:03Z")

</div>

Hi all!

Full disclosure: I’m a bit of a bro-ginner, only been working with bro for about a month now.

I’m working on a bro script to add a human-readable timestamp field to my (http) logs, but I’ve run into a bit of a pickle.

Though my script checks out (“bro is ok!”), installs just fine, and even adds the appropriate field…every entry in the field column is unset! I’m not sure where I’ve gone astray , and I would appreciate any pointers.

I’ve included the text of my script below.

Thank you!

-Dani

@load base/protocols/http

module HTTP;

export {  
redef record Info += {

## A human-readable timestamp

human\_time: string &log &optional;  
};  
}

event time\_translate(c: connection, rec: HTTP::Info)  
{  
local format: string = “%F-%H-%M”;  
c$http$human\_time = strftime(format, rec$ts);  
}

---

<div class="post-metadata">

**Author:** ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\
**Post date:** [August 7, 2013, 5:02pm UTC](https://community.zeek.org/t/adding-a-human-readable-timestamp-field/2768/2 "2013-08-07T17:02:20Z")

</div>

Seth,

I see a lot of these...any chance we could get a config feature request that would default to human readable.

James

---

<div class="post-metadata">

**Author:** ![Azoff\_Justin](https://avatars.discourse-cdn.com/v4/letter/a/5fc32e/32.png) [@Azoff\_Justin](https://community.zeek.org/u/Azoff_Justin)\
**Post date:** [August 7, 2013, 5:48pm UTC](https://community.zeek.org/t/adding-a-human-readable-timestamp-field/2768/3 "2013-08-07T17:48:34Z")

</div>

You're right up to here.. the problem is nothing will trigger the  
time\_translate event. You need to use one of the existing events that  
will fire for http connections.

I would try:

event HTTP::log\_http(rec: HTTP::Info)  
{  
&nbsp;&nbsp;&nbsp;&nbsp;..  
}

I believe that fires just before the entry is logged, if that doesn't  
work an event like connection\_established or http\_request would  
definitely work.

---

<div class="post-metadata">

**Author:** ![Dani\_Witherspoon](https://avatars.discourse-cdn.com/v4/letter/d/5e9695/32.png) [@Dani\_Witherspoon](https://community.zeek.org/u/Dani_Witherspoon)\
**Post date:** [August 8, 2013, 1:10pm UTC](https://community.zeek.org/t/adding-a-human-readable-timestamp-field/2768/4 "2013-08-08T13:10:43Z")

</div>

Thank you so much, Justin! This did the trick – I really appreciate the guidance!

If anybody’s interested, here’s the working bro-code:

@load base/protocols/http

module HTTP;

export {  
redef record Info += {

## A human-readable timestamp

human\_time: string &log &optional;  
};  
}

event http\_request(c: connection, method: string, original\_URI: string, unescaped\_URI: string, version: string)  
{  
local format: string = “%F, %H:%M”;  
c$http$human\_time = strftime(format, c$http$ts);  
}

---

<div class="post-metadata">

**Author:** ![Harrison\_Wood](https://avatars.discourse-cdn.com/v4/letter/h/c4cdca/32.png) [@Harrison\_Wood](https://community.zeek.org/u/Harrison_Wood)\
**Post date:** [August 8, 2013, 4:09pm UTC](https://community.zeek.org/t/adding-a-human-readable-timestamp-field/2768/5 "2013-08-08T16:09:56Z")

</div>

Thanks for posting your script! I just added it to my install so I can stop doing date -d@ all the time.

---

<div class="post-metadata">

**Author:** ![Dani\_Witherspoon](https://avatars.discourse-cdn.com/v4/letter/d/5e9695/32.png) [@Dani\_Witherspoon](https://community.zeek.org/u/Dani_Witherspoon)\
**Post date:** [August 8, 2013, 4:30pm UTC](https://community.zeek.org/t/adding-a-human-readable-timestamp-field/2768/6 "2013-08-08T16:30:40Z")

</div>

No worries! This only works for HTTP logs – you’d have to edit it for other protocols, which I’ve done for SSL, FTP, and SSH. I’ve included those scripts below, in case anybody else would like to use them. Let me know if any issues crop up, or if the coding isn’t in the bro-spirit. 🙂

# File: human\_time\_ftp.bro

@load base/protocols/ftp

module FTP;

export {  
redef record Info += {

## A human-readable timestamp

human\_time: string &log &optional;  
};  
}

event ftp\_request(c: connection , command: string , arg: string)  
{  
local format: string = “%F, %H:%M:%S”;  
c$ftp$human\_time = strftime(format, c$ftp$ts);  
}

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:41pm UTC](https://community.zeek.org/t/adding-a-human-readable-timestamp-field/2768/7 "2022-05-06T15:41:08Z")

</div>