# "bro-cut -d | grep" vs. "grep | bro-cut -d"

**URL:** <https://community.zeek.org/t/bro-cut-d-grep-vs-grep-bro-cut-d/2620>\
**Category:** Zeek\
**Created:** [March 29, 2013, 3:17pm UTC](https://community.zeek.org/t/bro-cut-d-grep-vs-grep-bro-cut-d/2620 "2013-03-29T15:17:52Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\
**Post date:** [March 29, 2013, 3:17pm UTC](https://community.zeek.org/t/bro-cut-d-grep-vs-grep-bro-cut-d/2620/1 "2013-03-29T15:17:52Z")

</div>

Topic (sorta) says it. Example:

[08:49:21 ids:~/broarchive/03-28-2013$] zcat dns.log.gz | grep light | bro-cut -d

[08:49:25 ids:~/broarchive/03-28-2013$] zcat dns.log.gz | bro-cut -d | grep light  
2013-03-28T20:42:09-0600 X8KFdodB5Ie x.x.x.x 55051 x.x.x.x 53 udp 43494 [www.lighting.com](http://www.lighting.com) 1 C\_INTERNET 1 A 0 NOERROR F F T T 0 x.x.x.x 3600.000000  
[08:49:50 ids:~/broarchive/03-28-2013$]

I'd like to grep out the content before sending to bro-cut as it takes a fraction of the time (as shown above). I've made sure that no colorization is happening. Any hints on how I can get this to fly? Thank you.

James

---

<div class="post-metadata">

**Author:** ![jessebowling](https://avatars.discourse-cdn.com/v4/letter/j/f9ae1b/32.png) [@jessebowling](https://community.zeek.org/u/jessebowling)\
**Post date:** [March 29, 2013, 3:50pm UTC](https://community.zeek.org/t/bro-cut-d-grep-vs-grep-bro-cut-d/2620/2 "2013-03-29T15:50:54Z")

</div>

Hi James,

I asked a similar question under a subject like “Feature request; up to 50% done?” and got this answer from Seth, which solves some of the problems I think you’re trying to solve…

Cheers,

Jesse

> So, I suppose I’m requesting that someone with more gawk chops than myself give a shot at integrating this into bro-cut

I tend to use these lines in my profile…

alias bro-column=“sed "s/fields.//;s/types.//" | column -s $‘\t’ -t”  
alias bro-awk=‘awk -F" "’  
bro-grep() { grep -E “(^#)|$1” $2; }  
bro-zgrep() { zgrep -E “(^#)|$1” $2; }

What you’re trying to do can then be accomplished like this…

bro-zgrep ‘10.10.10.10’ /usr/local/bro/logs/conn.\*.log.gz | bro-cut id.orig\_h,id.resp\_h

It _would_ be handy to be able to do this through bro-cut though but that would make bro-cut start to sound like an incorrectly named utility. 🙂

Have you tried using the ElasticSearch writer and Brownian?

.Seth

---

<div class="post-metadata">

**Author:** ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\
**Post date:** [March 29, 2013, 4:34pm UTC](https://community.zeek.org/t/bro-cut-d-grep-vs-grep-bro-cut-d/2620/3 "2013-03-29T16:34:46Z")

</div>

Thanks for the repost Jess, that helps 🙂

James

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:40pm UTC](https://community.zeek.org/t/bro-cut-d-grep-vs-grep-bro-cut-d/2620/4 "2022-05-06T15:40:53Z")

</div>