# How to modify http.log

**URL:** <https://community.zeek.org/t/how-to-modify-http-log/3624>\
**Category:** Zeek\
**Created:** [May 27, 2015, 10:03am UTC](https://community.zeek.org/t/how-to-modify-http-log/3624 "2015-05-27T10:03:15Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vito\_Logrillo](https://avatars.discourse-cdn.com/v4/letter/v/e9bcb4/32.png) [@Vito\_Logrillo](https://community.zeek.org/u/Vito_Logrillo)\
**Post date:** [May 27, 2015, 10:03am UTC](https://community.zeek.org/t/how-to-modify-http-log/3624/1 "2015-05-27T10:03:15Z")

</div>

Hi all,  
i'm trying to modify http.log using the script written below

-----script.bro-----  
redef record HTTP::Info += {  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;host\_ip: set[addr] &optional &log;  
};

event connection\_state\_remove(c: connection) &priority=5  
{  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;local record\_flag: bool = F;

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if (/^[hH][tT][tT][pP]😕 in c$http$uri)  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;record\_flag = T;

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;when (local h = lookup\_hostname(c$http$host))  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;record\_flag = F;  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;print(h);  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if (|h|\>0 && (0.0.0.0 !in h))  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;c$http$host\_ip = h;  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Log::write(HTTP::LOG, c$http);  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return;  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if (record\_flag == T)  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return;  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}  
}

-----end script.bro----

I've added a new field in http.log (host\_ip) in order to see the host  
ip using the function lookup\_hostname.  
The script works well, but the same record is written twice (with and  
without the host\_ip field).  
I've tried to use a state flag (record\_flag) to avoid this, but the  
result is the same.  
How can avoid record duplicantion?  
Thanks,  
Vito

---

<div class="post-metadata">

**Author:** ![Vlad\_Grigorescu1](https://avatars.discourse-cdn.com/v4/letter/v/f9ae1b/32.png) [@Vlad\_Grigorescu1](https://community.zeek.org/u/Vlad_Grigorescu1)\
**Post date:** [May 27, 2015, 4:01pm UTC](https://community.zeek.org/t/how-to-modify-http-log/3624/2 "2015-05-27T16:01:29Z")

</div>

Log::write is already being called in the base scripts. You want to add a field to the record and let the base scripts worry about actually logging it out. See policy/protocols/http/var-extraction-cookies.bro ([https://github.com/bro/bro/blob/master/scripts/policy/protocols/http/var-extraction-cookies.bro](https://github.com/bro/bro/blob/master/scripts/policy/protocols/http/var-extraction-cookies.bro)) as an example.

You might not be able to do what you want, though, because lookup\_hostname is an asynchronous function. If it doesn’t return quickly enough, the log will be written without the field filled in. Another thing to keep in mind is that a large number of asynchronous calls can have a significant performance penalty.

c$http, c$http$uri and c$http$host are optional fields[1], so you should check for the presence of those fields with the ?$ operator before accessing them. Finally, the scheme (http://) is not included in the uri field, so I’m not really sure how your if statement is matching. I would replace that if condition with: c?$http && c$http?$host. If the host field is set, you know it’s HTTP and that you saw the request.

–Vlad

[1] - \<[https://www.bro.org/sphinx-git/scripts/base/protocols/http/main.bro.html#type-HTTP::Info](https://www.bro.org/sphinx-git/scripts/base/protocols/http/main.bro.html#type-HTTP::Info)\>

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:42pm UTC](https://community.zeek.org/t/how-to-modify-http-log/3624/3 "2022-05-06T15:42:42Z")

</div>

Closed on May 6, 2022, 3:42pm UTC