Hi. Is there a way to eliminate the descriptive record banner that is the first line of the log file?
You can do this per-log or globally.
Depending on what this is for, it may be beneficial to just output your log as JSON:
If you want to do either of these settings only in a single log, you can do this…
local filt = Log::Filter($name="default",
$config=table(["include_meta"] = "F"));
You should be able to configure any of the other global ascii log settings the same as I did in that example.
Tangentially but related: I just had a look at the code for ascii.bro. It seems that I can't have both JSON and "normal" text, is that correct?
("But why would you want to?" Because I want to have my cake and eat it too )
Sure you can! That use_json name is available for use in the $config table that I used in my filter configuration.
Th global setting did not appear to work, but the individual LOG
filter line did .