# Log File Modifications

**URL:** <https://community.zeek.org/t/log-file-modifications/4536>\
**Category:** Zeek\
**Created:** [December 6, 2016, 7:48pm UTC](https://community.zeek.org/t/log-file-modifications/4536 "2016-12-06T19:48:52Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dave\_Crawford](https://avatars.discourse-cdn.com/v4/letter/d/919ad9/32.png) [@Dave\_Crawford](https://community.zeek.org/u/Dave_Crawford)\
**Post date:** [December 6, 2016, 7:48pm UTC](https://community.zeek.org/t/log-file-modifications/4536/1 "2016-12-06T19:48:52Z")

</div>

Is it possible (via scripts vs code modifications) to rename existing columns in a log file? The logging documentation has examples for filtering out specific events, or adding additional columns, but I couldn't find a reference for renaming.

Thanks,  
-Dave

---

<div class="post-metadata">

**Author:** ![Daniel\_Thayer](https://avatars.discourse-cdn.com/v4/letter/d/8dc957/32.png) [@Daniel\_Thayer](https://community.zeek.org/u/Daniel_Thayer)\
**Post date:** [December 7, 2016, 1:13am UTC](https://community.zeek.org/t/log-file-modifications/4536/2 "2016-12-07T01:13:48Z")

</div>

You can do something like this:

redef Log::default\_field\_name\_map = {  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;["id.orig\_h"] = "src",  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;["id.orig\_p"] = "src\_port",  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;["id.resp\_h"] = "dst",  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;["id.resp\_p"] = "dst\_port",  
};

---

<div class="post-metadata">

**Author:** ![Dave\_Crawford](https://avatars.discourse-cdn.com/v4/letter/d/919ad9/32.png) [@Dave\_Crawford](https://community.zeek.org/u/Dave_Crawford)\
**Post date:** [December 7, 2016, 2:16am UTC](https://community.zeek.org/t/log-file-modifications/4536/3 "2016-12-07T02:16:50Z")

</div>

Thanks for the pointer Daniel! I was able to find the documentation here: [https://www.bro.org/sphinx-git/scripts/base/frameworks/logging/main.bro.html#id-Log::default\_field\_name\_map](https://www.bro.org/sphinx-git/scripts/base/frameworks/logging/main.bro.html#id-Log::default_field_name_map)

I also have this working at the filter level now as well and helps me reduce overhead on the Splunk side.

-Dave

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:44pm UTC](https://community.zeek.org/t/log-file-modifications/4536/4 "2022-05-06T15:44:22Z")

</div>