# How to write TSV logs with ISO timestamps

**URL:** <https://community.zeek.org/t/how-to-write-tsv-logs-with-iso-timestamps/6756>\
**Category:** Zeek\
**Created:** [October 17, 2022, 8:45pm UTC](https://community.zeek.org/t/how-to-write-tsv-logs-with-iso-timestamps/6756 "2022-10-17T20:45:07Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![tonyspark](https://avatars.discourse-cdn.com/v4/letter/t/a4c791/32.png) [@tonyspark](https://community.zeek.org/u/tonyspark)\
**Post date:** [October 17, 2022, 8:45pm UTC](https://community.zeek.org/t/how-to-write-tsv-logs-with-iso-timestamps/6756/1 "2022-10-17T20:45:07Z")

</div>

What is the best way to convert the ts field of all log types into ISO format when written out using Ascii/TSV? Similar to -d for zeek-cut. I am not using json format so cannot use JSON::TS\_ISO8601, but would like to do the equivalent for TSV.

I have looked through the topics here and have not been able to find an answer. Looking at the documentation it seems like Log::log\_stream\_policy hook could be used for this, but am having difficulty finding an example of this.

Any ideas or past solutions? Why was this never implemented along with the json functionality for date format?

---

<div class="post-metadata">

**Author:** ![awelzel](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/awelzel/32/609_2.png) [@awelzel](https://community.zeek.org/u/awelzel)\
**Post date:** [October 25, 2022, 10:10am UTC](https://community.zeek.org/t/how-to-write-tsv-logs-with-iso-timestamps/6756/2 "2022-10-25T10:10:56Z")

</div>

Hey @tonyspark

> Any ideas or past solutions? Why was this never implemented along with the json functionality for date format?

Nothing that comes immediately to mind, but others might know more. Suspect post-processing/rotation with `zeek-cut -d` would be one option. It might also just be a missing feature to align with the JSON writer that no one has yet requested/needed (?).

Would you be up opening a feature request on the [Github zeek/zeek](https://github.com/zeek/zeek/issues) project?

---

<div class="post-metadata">

**Author:** ![awelzel](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/awelzel/32/609_2.png) [@awelzel](https://community.zeek.org/u/awelzel)\
**Post date:** [November 3, 2022, 1:22pm UTC](https://community.zeek.org/t/how-to-write-tsv-logs-with-iso-timestamps/6756/3 "2022-11-03T13:22:08Z")

</div>

Opened a discussion here: [Configurable TSV timestamp format · Discussion #2536 · zeek/zeek · GitHub](https://github.com/zeek/zeek/discussions/2536)