Logging in multiple formats

Zeek
1

Hi All,
I’ve seen examples in how you can log everything in JSON, individual logs in JSON, or everything in the regular log format. I have a use case in which I would like to be able to log output in both JSON and the regular log format as I have a set of consumers that easily ingest JSON and a set that doesn’t enjoy it quite so much.

Is there a way to log in both formats easily similar to how Suricata can emit both JSON and other log types all at once?

Thanks,
Carl

2

Hi Carl,

Is there a way to log in both formats easily similar to how Suricata can
emit both JSON and other log types all at once?

once I ran into the same problem and wrote a small script that might
help: Additional JSON logging for Bro. · GitHub

It adds a filter to generate additional JSON logs for the configured log
streams.

Hope this helps,
Jan