# Disable Log Stream but not the analyzers

**URL:** <https://community.zeek.org/t/disable-log-stream-but-not-the-analyzers/5537>\
**Category:** Zeek\
**Created:** [November 21, 2018, 9:28am UTC](https://community.zeek.org/t/disable-log-stream-but-not-the-analyzers/5537 "2018-11-21T09:28:32Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Alex\_Kefallonitis](https://avatars.discourse-cdn.com/v4/letter/a/f9ae1b/32.png) [@Alex\_Kefallonitis](https://community.zeek.org/u/Alex_Kefallonitis)\
**Post date:** [November 21, 2018, 9:28am UTC](https://community.zeek.org/t/disable-log-stream-but-not-the-analyzers/5537/1 "2018-11-21T09:28:32Z")

</div>

I have disabled the Log Stream for HTTP :

event bro\_init()  
{  
Log::disable\_stream(HTTP::LOG);  
}

But i want scripts using HTTP protocol to work e.g [https://raw.githubusercontent.com/sethhall/bro-scripts/master/top-websites.bro](https://raw.githubusercontent.com/sethhall/bro-scripts/master/top-websites.bro)

Is there any other way to do it ?

---

<div class="post-metadata">

**Author:** ![Azoff\_Justin\_S](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@Azoff\_Justin\_S](https://community.zeek.org/u/Azoff_Justin_S)\
**Post date:** [November 21, 2018, 9:03pm UTC](https://community.zeek.org/t/disable-log-stream-but-not-the-analyzers/5537/2 "2018-11-21T21:03:23Z")

</div>

Hi,

Using

Log::remove\_default\_filter(HTTP::LOG);

instead of disable\_stream should do what you want.

---

<div class="post-metadata">

**Author:** ![Alex\_Kefallonitis](https://avatars.discourse-cdn.com/v4/letter/a/f9ae1b/32.png) [@Alex\_Kefallonitis](https://community.zeek.org/u/Alex_Kefallonitis)\
**Post date:** [November 22, 2018, 8:39am UTC](https://community.zeek.org/t/disable-log-stream-but-not-the-analyzers/5537/3 "2018-11-22T08:39:37Z")

</div>

Hi i did change it but no logs regarding http are produced like [https://raw.githubusercontent.com/sethhall/bro-scripts/master/top-websites.bro](https://raw.githubusercontent.com/sethhall/bro-scripts/master/top-websites.bro) or [https://github.com/BrashEndeavours/bro-scripts/blob/master/http\_entropy.bro](https://github.com/BrashEndeavours/bro-scripts/blob/master/http_entropy.bro) .

![image.png](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/90968a9c8c24fc7331be2f6ab5c4939e19c49abb.png)

 ![image.png](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/466790721713a6b97bac1119f3cb99960a20ed2e.png)

Στις Τετ, 21 Νοε 2018 στις 11:03 μ.μ., ο/η Azoff, Justin S \<[jazoff@illinois.edu](mailto:jazoff@illinois.edu)\> έγραψε:

---

<div class="post-metadata">

**Author:** ![Michal\_Purzynski1](https://avatars.discourse-cdn.com/v4/letter/m/a88e57/32.png) [@Michal\_Purzynski1](https://community.zeek.org/u/Michal_Purzynski1)\
**Post date:** [November 22, 2018, 8:58am UTC](https://community.zeek.org/t/disable-log-stream-but-not-the-analyzers/5537/4 "2018-11-22T08:58:06Z")

</div>

Indeed, scripts you’re showing depend on the log streams you just disabled.

---

<div class="post-metadata">

**Author:** ![Alex\_Kefallonitis](https://avatars.discourse-cdn.com/v4/letter/a/f9ae1b/32.png) [@Alex\_Kefallonitis](https://community.zeek.org/u/Alex_Kefallonitis)\
**Post date:** [November 22, 2018, 10:05am UTC](https://community.zeek.org/t/disable-log-stream-but-not-the-analyzers/5537/5 "2018-11-22T10:05:48Z")

</div>

So there is no way to disable specific logs but still use the analyzers in the script ? The scripts are reading the actual logs and needed from them to work ?

Στις Πέμ, 22 Νοε 2018 στις 10:58 π.μ., ο/η Michał Purzyński \<[michalpurzynski1@gmail.com](mailto:michalpurzynski1@gmail.com)\> έγραψε:

---

<div class="post-metadata">

**Author:** ![Azoff\_Justin\_S](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@Azoff\_Justin\_S](https://community.zeek.org/u/Azoff_Justin_S)\
**Post date:** [November 23, 2018, 4:47pm UTC](https://community.zeek.org/t/disable-log-stream-but-not-the-analyzers/5537/6 "2018-11-23T16:47:03Z")

</div>

Read my response again…

Using Log::remove\_default\_filter does what you want. You used remove\_stream which is something different.

---

<div class="post-metadata">

**Author:** ![Alex\_Kefallonitis](https://avatars.discourse-cdn.com/v4/letter/a/f9ae1b/32.png) [@Alex\_Kefallonitis](https://community.zeek.org/u/Alex_Kefallonitis)\
**Post date:** [November 24, 2018, 8:19am UTC](https://community.zeek.org/t/disable-log-stream-but-not-the-analyzers/5537/7 "2018-11-24T08:19:52Z")

</div>

Yes you are correct it works ! Thanks a lot

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:46pm UTC](https://community.zeek.org/t/disable-log-stream-but-not-the-analyzers/5537/8 "2022-05-06T15:46:12Z")

</div>

Closed on May 6, 2022, 3:46pm UTC