# Question : How can I change a particular log file format?

**URL:** <https://community.zeek.org/t/question-how-can-i-change-a-particular-log-file-format/4076>\
**Category:** Zeek\
**Created:** [March 27, 2016, 8:56am UTC](https://community.zeek.org/t/question-how-can-i-change-a-particular-log-file-format/4076 "2016-03-27T08:56:12Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Aneela\_Safdar](https://avatars.discourse-cdn.com/v4/letter/a/919ad9/32.png) [@Aneela\_Safdar](https://community.zeek.org/u/Aneela_Safdar)\
**Post date:** [March 27, 2016, 8:56am UTC](https://community.zeek.org/t/question-how-can-i-change-a-particular-log-file-format/4076/1 "2016-03-27T08:56:12Z")

</div>

Hi,

I am a newbie at bro and wanted to change log format of http.log file to json.  
Currently I have made changes in ascii.bro and now I am getting all logs format in json but what I have to do if I only want http.log to have that format and others keep default?

Also my log files have got still .log extension, how can I change it o .json?

Thanks,

Regards,  
Aneela Safdar

---

<div class="post-metadata">

**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\
**Post date:** [April 1, 2016, 8:59am UTC](https://community.zeek.org/t/question-how-can-i-change-a-particular-log-file-format/4076/2 "2016-04-01T08:59:10Z")

</div>

Hello Aneela,

> I am a newbie at bro and wanted to change log format of http.log file to  
> json. Currently I have made changes in ascii.bro and now I am getting  
> all logs format in json but what I have to do if I only want http.log to  
> have that format and others keep default?

you can do something like this in bro\_init:

local f = Log::get\_filter(HTTP::LOG, "default"); # get default filter  
f$config = table(["use\_json"] = "T"); # set json config option  
Log::add\_filter(HTTP::LOG, f); # replace default filter

> Also my log files have got still .log extension, how can I change it o .json?

You sadly cannot change it for a single log file, just for all of them (by  
setting the BRO\_LOG\_SUFFIX environment variable).

I hope this helps,  
Johanna

---

<div class="post-metadata">

**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\
**Post date:** [April 3, 2016, 6:50pm UTC](https://community.zeek.org/t/question-how-can-i-change-a-particular-log-file-format/4076/3 "2016-04-03T18:50:49Z")

</div>

Alternately, you can just add the following line in a script (to avoid changing base scripts)...  
&nbsp;&nbsp;redef LogAscii::use\_json = T;

Of course, Johanna's reply still applies since it sounds like you don't want to make that change to all of your logs.

&nbsp;&nbsp;.Seth

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:43pm UTC](https://community.zeek.org/t/question-how-can-i-change-a-particular-log-file-format/4076/4 "2022-05-06T15:43:32Z")

</div>