Logs Conversion

Zeek
1

Hi there.
I have been collecting log file using bro and all the log file that I received is in .log file and I logs in .json formate. Is there any way to convert that log files into .json formate?? any idea??

I am trying to convert this using " sudo bro -i wlp1s0 -e ‘redef LogAscii::use_json=T;’ "

But getting no result.?

thanks regards

Syed Shahzaib

2

You can edit /opt/bro/share/bro/site/local.bro (assuming you’ve installed it to /opt/bro) and add "@load policy/tuning/json-logs.bro” (without quotes) and then redeploy Bro.