Hello,
I’m using the script below, but when presented in my logs the field is _my_server_name instead of my_server_name. I’ve tried multiple ways at removing the initial underscore but being new to this scripting I can’t seem to resolve the issue.
#Zeek
option my_server_name = “Zeek-server1”;
type MyLogExtension: record {
server_name: string &log;
};
function add_my_log_extension(path: string): MyLogExtension
{
return MyLogExtension($server_name = my_server_name);
}
redef Log::default_ext_func = add_my_log_extension;