# Creating multiple notice logs
**URL:** https://community.zeek.org/t/creating-multiple-notice-logs/4157
**Category:** Zeek
**Created:** [May 13, 2016, 2:44pm UTC](https://community.zeek.org/t/creating-multiple-notice-logs/4157 "2016-05-13T14:44:09Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Dave\_Crawford](https://community.zeek.org/u/Dave_Crawford)
#### Post date: [May 13, 2016, 2:44pm UTC](https://community.zeek.org/t/creating-multiple-notice-logs/4157/1 "2016-05-13T14:44:09Z")
Does anyone have an example of diverting specific notices to a new log file?
Is the right approach to hook "Notice::policy" (with priority), Log:write to the new log stream and then 'break' from the hook?
-Dave
---
### Author:  [@Azoff\_Justin\_S](https://community.zeek.org/u/Azoff_Justin_S)
#### Post date: [May 13, 2016, 3:00pm UTC](https://community.zeek.org/t/creating-multiple-notice-logs/4157/2 "2016-05-13T15:00:12Z")
Yes… you’re on the right track. As it turns out I have a script that does exactly that.
The input file is so I can have a file with rows like
#fields ip note reason timestamp
1.2.3.4 TeamCymruMalwareHashRegistry::Match test box 1445362562
The key thing that my script does is
n$actions = set();
If you just wanted to move some notices to a different log file you could accomplish that much easier by using Log::add\_filter with a path\_func.
[ignore-notices.bro](https://community.zeek.org/uploads/short-url/upXwnJkjVNtU7RfX0NtN4CvPdds.bro) (1 KB)
---
### Author:  [@Dave\_Crawford](https://community.zeek.org/u/Dave_Crawford)
#### Post date: [May 13, 2016, 7:08pm UTC](https://community.zeek.org/t/creating-multiple-notice-logs/4157/3 "2016-05-13T19:08:15Z")
Thanks Justin,
The add\_filter option you mentioned is probably the better route. I’m just looking to move "PacketFilter::Dropped\_Packets” notices to a separate log.
---
### Author:  [@system](https://community.zeek.org/u/system)
#### Post date: [May 6, 2022, 3:43pm UTC](https://community.zeek.org/t/creating-multiple-notice-logs/4157/4 "2022-05-06T15:43:41Z")