# Bro eliminating banner in log files .

**URL:** <https://community.zeek.org/t/bro-eliminating-banner-in-log-files/3395>\
**Category:** Zeek\
**Created:** [December 14, 2014, 9:44pm UTC](https://community.zeek.org/t/bro-eliminating-banner-in-log-files/3395 "2014-12-14T21:44:55Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![John\_Donnelly](https://avatars.discourse-cdn.com/v4/letter/j/3ec8ea/32.png) [@John\_Donnelly](https://community.zeek.org/u/John_Donnelly)\
**Post date:** [December 14, 2014, 9:44pm UTC](https://community.zeek.org/t/bro-eliminating-banner-in-log-files/3395/1 "2014-12-14T21:44:55Z")

</div>

Hi. Is there a way to eliminate the descriptive record banner that is the first line of the log file?

---

<div class="post-metadata">

**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\
**Post date:** [December 15, 2014, 2:59pm UTC](https://community.zeek.org/t/bro-eliminating-banner-in-log-files/3395/2 "2014-12-15T14:59:36Z")

</div>

You can do this per-log or globally.

Globally:  
&nbsp;&nbsp;redef LogAscii::include\_meta=F;

Depending on what this is for, it may be beneficial to just output your log as JSON:  
&nbsp;&nbsp;redef LogAscii::use\_json=T;

If you want to do either of these settings only in a single log, you can do this…

event bro\_init()  
&nbsp;&nbsp;{  
&nbsp;&nbsp;Log::remove\_default\_filter(HTTP::LOG);  
&nbsp;&nbsp;local filt = Log::Filter($name="default",  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$writer=Log::WRITER\_ASCII,  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$config=table(["include\_meta"] = "F"));  
&nbsp;&nbsp;Log::add\_filter(HTTP::LOG, filt);  
&nbsp;&nbsp;}

You should be able to configure any of the other global ascii log settings the same as I did in that example.

&nbsp;&nbsp;.Seth

---

<div class="post-metadata">

**Author:** ![Mike\_Patterson](https://avatars.discourse-cdn.com/v4/letter/m/f475e1/32.png) [@Mike\_Patterson](https://community.zeek.org/u/Mike_Patterson)\
**Post date:** [December 15, 2014, 3:25pm UTC](https://community.zeek.org/t/bro-eliminating-banner-in-log-files/3395/3 "2014-12-15T15:25:32Z")

</div>

Tangentially but related: I just had a look at the code for ascii.bro. It seems that I can't have both JSON and "normal" text, is that correct?  
("But why would you want to?" Because I want to have my cake and eat it too 🙂 )

Mike

---

<div class="post-metadata">

**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\
**Post date:** [December 15, 2014, 3:32pm UTC](https://community.zeek.org/t/bro-eliminating-banner-in-log-files/3395/4 "2014-12-15T15:32:39Z")

</div>

Sure you can! That use\_json name is available for use in the $config table that I used in my filter configuration. 🙂

&nbsp;&nbsp;.Seth

---

<div class="post-metadata">

**Author:** ![John\_Donnelly](https://avatars.discourse-cdn.com/v4/letter/j/3ec8ea/32.png) [@John\_Donnelly](https://community.zeek.org/u/John_Donnelly)\
**Post date:** [December 15, 2014, 3:48pm UTC](https://community.zeek.org/t/bro-eliminating-banner-in-log-files/3395/5 "2014-12-15T15:48:27Z")

</div>

Thank you.

Th global setting did not appear to work, but the individual LOG  
filter line did .

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:42pm UTC](https://community.zeek.org/t/bro-eliminating-banner-in-log-files/3395/6 "2022-05-06T15:42:17Z")

</div>

Closed on May 6, 2022, 3:42pm UTC