# Bro Kafka logging plugin **URL:** \ **Category:** Zeek\ **Created:** [August 14, 2015, 6:17pm UTC](https://community.zeek.org/t/bro-kafka-logging-plugin/3769 "2015-08-14T18:17:09Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Aaron\_Gee-Clough](https://avatars.discourse-cdn.com/v4/letter/a/a3d4f5/32.png) [@Aaron\_Gee-Clough](https://community.zeek.org/u/Aaron_Gee-Clough)\ **Post date:** [August 14, 2015, 6:17pm UTC](https://community.zeek.org/t/bro-kafka-logging-plugin/3769/1 "2015-08-14T18:17:09Z")
All, I have a bro plugin that I've just finished writing that I'm hoping some folks will help test. It's a logging plugin that will send JSON-formatted bro logs to a Kafka message broker. The code is at: [https://github.com/g-clef/KafkaLogger](https://github.com/g-clef/KafkaLogger) . Rather than writing a simple log forwarder, I modified things a bit:   \* You can specify which logs to send to Kafka in the bro config.   \* It will add a "type" field to the JSON message to clarify which log the message came from ("http" vs "conn" vs "ssl", for example).   \* It will add a "sensor" field to the JSON message to allow you to tag logs from particular sensors in your network (if you have multiple bro sensors, you may want to be able to distinguish between logs from different sensors).   \* It will rename the "ts", "id.orig\_h", "id.orig\_p", "id.resp\_h", and "id.resp\_p" fields to more commonly-used names (for example, "ts" becomes "@timestamp" to interoperate with logstash-style logs). The plugin is pretty young, so I would consider this beta testing at the moment. It is working and seems to be stable in my testing, but I'd love to have some other folks than me testing it. Feel free to send me questions or pull requests. aaron ---
**Author:** ![Marcus\_LaFerrera](https://avatars.discourse-cdn.com/v4/letter/m/d78d45/32.png) [@Marcus\_LaFerrera](https://community.zeek.org/u/Marcus_LaFerrera)\ **Post date:** [August 17, 2015, 7:30pm UTC](https://community.zeek.org/t/bro-kafka-logging-plugin/3769/2 "2015-08-17T19:30:44Z")
Thanks for sharing Aaron. This is terrific. ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:42pm UTC](https://community.zeek.org/t/bro-kafka-logging-plugin/3769/3 "2022-05-06T15:42:58Z")