# outputting only a single log

**URL:** <https://community.zeek.org/t/outputting-only-a-single-log/4122>\
**Category:** Zeek\
**Created:** [April 25, 2016, 11:31pm UTC](https://community.zeek.org/t/outputting-only-a-single-log/4122 "2016-04-25T23:31:42Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Cody\_Shepherd](https://avatars.discourse-cdn.com/v4/letter/c/6f9a4e/32.png) [@Cody\_Shepherd](https://community.zeek.org/u/Cody_Shepherd)\
**Post date:** [April 25, 2016, 11:31pm UTC](https://community.zeek.org/t/outputting-only-a-single-log/4122/1 "2016-04-25T23:31:42Z")

</div>

Hi there,

Do you have a brief set of instructions for how to have a command like bro --iface output only one of the default logs? E.g. the conn.log.

![image001.png](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/becfb6189ba35d49b83f4434d72aa222561ca01d.png)

---

<div class="post-metadata">

**Author:** ![Matthias\_Vallentin1](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/matthias_vallentin1/32/596_2.png) [@Matthias\_Vallentin1](https://community.zeek.org/u/Matthias_Vallentin1)\
**Post date:** [April 26, 2016, 2:43am UTC](https://community.zeek.org/t/outputting-only-a-single-log/4122/2 "2016-04-26T02:43:00Z")

</div>

> Do you have a brief set of instructions for how to have a command like  
> bro --iface \<interface\> output only one of the default logs? E.g. the  
> conn.log.

Per the similar stackoverflow post [1], you can do this with:

&nbsp;&nbsp;&nbsp;&nbsp;bro -i \<interface\> -b base/protocols/conn

The flag -b runs Bro in "bare mode." This disables all default scripts.  
You can then manually turn on only the scripts you need.

&nbsp;&nbsp;&nbsp;&nbsp;Matthias

[1] [security - Bro: Log only one stream - Stack Overflow](http://stackoverflow.com/q/36853106/1170277)

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:43pm UTC](https://community.zeek.org/t/outputting-only-a-single-log/4122/3 "2022-05-06T15:43:37Z")

</div>


