# Changing separator

**URL:** <https://community.zeek.org/t/changing-separator/2869>\
**Category:** Zeek\
**Created:** [October 24, 2013, 3:10pm UTC](https://community.zeek.org/t/changing-separator/2869 "2013-10-24T15:10:00Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\
**Post date:** [October 24, 2013, 3:10pm UTC](https://community.zeek.org/t/changing-separator/2869/1 "2013-10-24T15:10:00Z")

</div>

So...I'm almost certain that there was a way to change from the tab character, to comma (I thought), but for the life of me I can't seem to find it. Been working with logstash and currently messages come through as:

1382627138.211512\tCQ74U23HZlcab0LNnh\t192.168.1.3\t64079\t224.0.0.1\t8612\tudp\t-\t-\t-\t-\tS0\tT\t0\tD\t1\t44\t0\t0\t(empty)

Which is kind of painful for matching. Any quick pointers on how to do this? Thank you.

James

---

<div class="post-metadata">

**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\
**Post date:** [October 24, 2013, 3:15pm UTC](https://community.zeek.org/t/changing-separator/2869/2 "2013-10-24T15:15:20Z")

</div>

Hi,

you can redefine Log::separator. See [http://www.bro.org/sphinx-git/scripts/base/frameworks/logging/main.html](http://www.bro.org/sphinx-git/scripts/base/frameworks/logging/main.html)

Johanna

---

<div class="post-metadata">

**Author:** ![Siwek\_Jon](https://avatars.discourse-cdn.com/v4/letter/s/90db22/32.png) [@Siwek\_Jon](https://community.zeek.org/u/Siwek_Jon)\
**Post date:** [October 24, 2013, 3:25pm UTC](https://community.zeek.org/t/changing-separator/2869/3 "2013-10-24T15:25:41Z")

</div>

[http://bro.org/sphinx-git/scripts/base/frameworks/logging/writers/ascii.html#id-LogAscii::separator](http://bro.org/sphinx-git/scripts/base/frameworks/logging/writers/ascii.html#id-LogAscii::separator)

Note that commas are already used for LogAscii::set\_separator, but you can change that, too.

- Jon

---

<div class="post-metadata">

**Author:** ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\
**Post date:** [October 24, 2013, 3:41pm UTC](https://community.zeek.org/t/changing-separator/2869/4 "2013-10-24T15:41:49Z")

</div>

Thanks for the responses gents...every little bit helps.

James

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:41pm UTC](https://community.zeek.org/t/changing-separator/2869/5 "2022-05-06T15:41:19Z")

</div>