# ASCII JSON log stream

**URL:** <https://community.zeek.org/t/ascii-json-log-stream/3683>\
**Category:** Zeek\
**Created:** [June 30, 2015, 7:52am UTC](https://community.zeek.org/t/ascii-json-log-stream/3683 "2015-06-30T07:52:57Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Albert\_Zaharovits](https://avatars.discourse-cdn.com/v4/letter/a/4da419/32.png) [@Albert\_Zaharovits](https://community.zeek.org/u/Albert_Zaharovits)\
**Post date:** [June 30, 2015, 7:52am UTC](https://community.zeek.org/t/ascii-json-log-stream/3683/1 "2015-06-30T07:52:57Z")

</div>

Hello,

I am writing a bro script which creates a ASCII log stream. I would like JSON output only for this stream. I was able to turn on JSON output globally.

Any idea?

Albert

---

<div class="post-metadata">

**Author:** ![Jan\_Grashoefer](https://avatars.discourse-cdn.com/v4/letter/j/d6d6ee/32.png) [@Jan\_Grashoefer](https://community.zeek.org/u/Jan_Grashoefer)\
**Post date:** [June 30, 2015, 8:07am UTC](https://community.zeek.org/t/ascii-json-log-stream/3683/2 "2015-06-30T08:07:48Z")

</div>

Hi Albert,

I have not tried this yet but regarding the documentation a filter may allow you to set JSON logging for a particular stream (see [https://www.bro.org/sphinx-git/scripts/base/frameworks/logging/writers/ascii.bro.html](https://www.bro.org/sphinx-git/scripts/base/frameworks/logging/writers/ascii.bro.html)).

Regards,  
Jan

---

<div class="post-metadata">

**Author:** ![Daniel\_Thayer](https://avatars.discourse-cdn.com/v4/letter/d/8dc957/32.png) [@Daniel\_Thayer](https://community.zeek.org/u/Daniel_Thayer)\
**Post date:** [June 30, 2015, 3:49pm UTC](https://community.zeek.org/t/ascii-json-log-stream/3683/3 "2015-06-30T15:49:01Z")

</div>

There is an example in the "Logging Framework" documentation that you can use:  
[https://www.bro.org/sphinx/frameworks/logging.html#ascii-writer](https://www.bro.org/sphinx/frameworks/logging.html#ascii-writer)

Just replace "tsv" in the example with "use\_json", and replace  
Conn::LOG with your log stream ID.

---

<div class="post-metadata">

**Author:** ![Albert\_Zaharovits](https://avatars.discourse-cdn.com/v4/letter/a/4da419/32.png) [@Albert\_Zaharovits](https://community.zeek.org/u/Albert_Zaharovits)\
**Post date:** [July 1, 2015, 12:05pm UTC](https://community.zeek.org/t/ascii-json-log-stream/3683/4 "2015-07-01T12:05:17Z")

</div>

Thank you!

This worked for me:  
event bro\_init()  
{  
&nbsp;&nbsp;local f = Log::get\_filter(MyLog::LOG, "default”);  
&nbsp;&nbsp;f$config = table(["use\_json"] = "T”);  
&nbsp;&nbsp;Log::add\_filter(MyLog::LOG, f);  
}

Albert

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:42pm UTC](https://community.zeek.org/t/ascii-json-log-stream/3683/5 "2022-05-06T15:42:49Z")

</div>

Closed on May 6, 2022, 3:42pm UTC