Set Zeek logs to json format

Zeek
1

I am setting up a local Zeek instance for my home network. I would like to set the log format to json. I have added

@load policy/tuning/json-logs.zeek

to the local.zeek file. I have stopped and started with zeekctl. The logs are still in TSV format.

I am running Ubuntu 22.04 on an Oracle Virtual Box instance.

2

Hi there — are you just missing a zeekctl deploy?

Also check out the Add-JSON package for more more fully featured JSON configuration.

3

Christian, That was the solution. Thanks for your quick reply.