How to write TSV logs with ISO timestamps

Zeek
1

What is the best way to convert the ts field of all log types into ISO format when written out using Ascii/TSV? Similar to -d for zeek-cut. I am not using json format so cannot use JSON::TS_ISO8601, but would like to do the equivalent for TSV.

I have looked through the topics here and have not been able to find an answer. Looking at the documentation it seems like Log::log_stream_policy hook could be used for this, but am having difficulty finding an example of this.

Any ideas or past solutions? Why was this never implemented along with the json functionality for date format?

2

Hey @tonyspark

Any ideas or past solutions? Why was this never implemented along with the json functionality for date format?

Nothing that comes immediately to mind, but others might know more. Suspect post-processing/rotation with zeek-cut -d would be one option. It might also just be a missing feature to align with the JSON writer that no one has yet requested/needed (?).

Would you be up opening a feature request on the Github zeek/zeek project?

3

Opened a discussion here: Configurable TSV timestamp format · Discussion #2536 · zeek/zeek · GitHub