# Customization for HTTP logs

**URL:** <https://community.zeek.org/t/customization-for-http-logs/2907>\
**Category:** Zeek\
**Created:** [November 21, 2013, 12:23pm UTC](https://community.zeek.org/t/customization-for-http-logs/2907 "2013-11-21T12:23:06Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![omer\_security](https://avatars.discourse-cdn.com/v4/letter/o/b782af/32.png) [@omer\_security](https://community.zeek.org/u/omer_security)\
**Post date:** [November 21, 2013, 12:23pm UTC](https://community.zeek.org/t/customization-for-http-logs/2907/1 "2013-11-21T12:23:06Z")

</div>

Hi,

In order to be able to log more HTTP headers, I edited the file:  
/bro/share/bro/base/protocols/http/main.bro (the edited file is attached to this mail).

In addition to this file change I added log filter into /bro/share/bro/site/local.bro file.

The log is created and most of fields logged well except the following fields:

> response\_content\_length  
> cookie  
> response\_content\_type  
>   
> |
> 
> - |

Can someone tell me what’s wrong ?

Thanks,

Omer

[main.bro](https://community.zeek.org/uploads/short-url/AqOmMZa0pI2aFfMXnn5pcyROk8N.bro) (11.2 KB)

---

<div class="post-metadata">

**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\
**Post date:** [November 21, 2013, 4:25pm UTC](https://community.zeek.org/t/customization-for-http-logs/2907/2 "2013-11-21T16:25:34Z")

</div>

> In order to be able to log more HTTP headers, I edited the file:  
> /bro/share/bro/base/protocols/http/main.bro (the edited file is attached to this mail).
> 
> In addition to this file change I added log filter into /bro/share/bro/site/local.bro file.
> 
> The log is created and most of fields logged well except the following fields:  
> response\_content\_length  
> cookie  
> response\_content\_type
> 
> Can someone tell me what's wrong ?

Are you sure that the server sends the header lines? As far as I remember all  
of them are optional. At a first glance, it looks fine besides that - and if the  
other things you added are working, these should too.

But - one other thing - you really should not edit script-files in base. If you ever  
re-install bro, it will be overwritten without any warning or promoting you. Also - if  
you ever update to a new version you will have to re-apply your changes manually.

Instead, you should extend the HTTP::Info record in a separate, new script-file and  
also set the values in that new file by catching the http\_header event.

Johanna

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:41pm UTC](https://community.zeek.org/t/customization-for-http-logs/2907/3 "2022-05-06T15:41:24Z")

</div>