# Question: using Log Filter Framework

**URL:** <https://community.zeek.org/t/question-using-log-filter-framework/5004>\
**Category:** Zeek\
**Created:** [August 29, 2017, 5:54pm UTC](https://community.zeek.org/t/question-using-log-filter-framework/5004 "2017-08-29T17:54:56Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![James\_Dickenson](https://avatars.discourse-cdn.com/v4/letter/j/9dc877/32.png) [@James\_Dickenson](https://community.zeek.org/u/James_Dickenson)\
**Post date:** [August 29, 2017, 5:54pm UTC](https://community.zeek.org/t/question-using-log-filter-framework/5004/1 "2017-08-29T17:54:56Z")

</div>

Hey All,

Hey I've been trying to use the log filter framework to filter out  
various things like certain IP ranges and other records. Here is my  
attempt but Bro is complaining about line 8 saying my syntax isn't  
correct. Does anyone know what I'm doing wrong? I've been using  
Seth's blog post on the framework as an example of how to build the  
log filters. ---\>  
[http://blog.bro.org/2012/02/filtering-logs-with-bro.html](http://blog.bro.org/2012/02/filtering-logs-with-bro.html)

Thanks in advance!

-James D.

###### code #######

global filter\_ip\_set: subnet = 1.0.0.0/8 &redef;

event bro\_init()  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Log::remove\_default\_filter(HTTP::LOG);  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Log::add\_filter(HTTP::LOG, [$name="orig\_h\_filter",  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$pred(rec: HTTP::Info) = {  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;rec$id$orig\_h in $filter\_ip\_set;  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;} ]);  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Log::add\_filter(HTTP::LOG, [$name="resp\_h\_filter",  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$pred(rec: HTTP::Info) = {  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;rec$id$resp\_h in $filter\_ip\_set;  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;} ]);  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}

---

<div class="post-metadata">

**Author:** ![Azoff\_Justin\_S](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@Azoff\_Justin\_S](https://community.zeek.org/u/Azoff_Justin_S)\
**Post date:** [August 29, 2017, 6:14pm UTC](https://community.zeek.org/t/question-using-log-filter-framework/5004/2 "2017-08-29T18:14:38Z")

</div>

That just has 2 small issues:

$filter\_ip\_set should be filter\_ip\_set and the pred function needs to return a boolean, so:

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Log::add\_filter(HTTP::LOG, [$name="orig\_h\_filter",  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$pred(rec: HTTP::Info) = {  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return rec$id$orig\_h in filter\_ip\_set;  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;} ]);

Personally I'd format that sort of thing like

&nbsp;&nbsp;&nbsp;&nbsp;Log::add\_filter(HTTP::LOG, [  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$name="orig\_h\_filter",  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$pred(rec: HTTP::Info) = {  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return rec$id$orig\_h in filter\_ip\_set;  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}  
&nbsp;&nbsp;&nbsp;&nbsp;]);

Also, not sure if that is just an example, but you'd probably want something like

&nbsp;&nbsp;&nbsp;&nbsp;Log::add\_filter(HTTP::LOG, [  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$name="host\_filter",  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$pred(rec: HTTP::Info) = {  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return rec$id$orig\_h in filter\_ip\_set || rec$id$resp\_h in filter\_ip\_set;  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}  
&nbsp;&nbsp;&nbsp;&nbsp;]);

Finally.. if you are doing more complicated things in the pred function splitting the statement up can help readability.

function interesting\_connections(rec: HTTP::Info): bool  
{  
&nbsp;&nbsp;&nbsp;&nbsp;return rec$id$orig\_h in filter\_ip\_set || rec$id$resp\_h in filter\_ip\_set;  
}

event bro\_init()  
{  
&nbsp;&nbsp;&nbsp;&nbsp;local filter: Log::Filter = [$name="host\_filter", $pred=interesting\_connections];  
&nbsp;&nbsp;&nbsp;&nbsp;Log::add\_filter(HTTP::LOG, filter);  
}

---

<div class="post-metadata">

**Author:** ![James\_Dickenson](https://avatars.discourse-cdn.com/v4/letter/j/9dc877/32.png) [@James\_Dickenson](https://community.zeek.org/u/James_Dickenson)\
**Post date:** [August 29, 2017, 8:31pm UTC](https://community.zeek.org/t/question-using-log-filter-framework/5004/3 "2017-08-29T20:31:06Z")

</div>

Thanks Justin!

That did the trick, now I can start getting myself into deeper trouble!

-James

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:45pm UTC](https://community.zeek.org/t/question-using-log-filter-framework/5004/4 "2022-05-06T15:45:14Z")

</div>