ASCII JSON log stream


I am writing a bro script which creates a ASCII log stream. I would like JSON output only for this stream. I was able to turn on JSON output globally.

Any idea?


Hi Albert,

I have not tried this yet but regarding the documentation a filter may allow you to set JSON logging for a particular stream (see


There is an example in the "Logging Framework" documentation that you can use:

Just replace "tsv" in the example with "use_json", and replace
Conn::LOG with your log stream ID.

Thank you!

This worked for me:
event bro_init()
  local f = Log::get_filter(MyLog::LOG, "default”);
  f$config = table(["use_json"] = "T”);
  Log::add_filter(MyLog::LOG, f);