ASCII JSON log stream

Zeek
1

Hello,

I am writing a bro script which creates a ASCII log stream. I would like JSON output only for this stream. I was able to turn on JSON output globally.

Any idea?

Albert

2

Hi Albert,

I have not tried this yet but regarding the documentation a filter may allow you to set JSON logging for a particular stream (see https://www.bro.org/sphinx-git/scripts/base/frameworks/logging/writers/ascii.bro.html).

Regards,
Jan

3

There is an example in the "Logging Framework" documentation that you can use:
https://www.bro.org/sphinx/frameworks/logging.html#ascii-writer

Just replace "tsv" in the example with "use_json", and replace
Conn::LOG with your log stream ID.

4

Thank you!

This worked for me:
event bro_init()
{
  local f = Log::get_filter(MyLog::LOG, "default”);
  f$config = table(["use_json"] = "T”);
  Log::add_filter(MyLog::LOG, f);
}

Albert