# Specification of log fields

**URL:** <https://community.zeek.org/t/specification-of-log-fields/2804>\
**Category:** Zeek\
**Created:** [September 4, 2013, 5:14pm UTC](https://community.zeek.org/t/specification-of-log-fields/2804 "2013-09-04T17:14:07Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nuno\_Rodrigues](https://avatars.discourse-cdn.com/v4/letter/n/f1d935/32.png) [@Nuno\_Rodrigues](https://community.zeek.org/u/Nuno_Rodrigues)\
**Post date:** [September 4, 2013, 5:14pm UTC](https://community.zeek.org/t/specification-of-log-fields/2804/1 "2013-09-04T17:14:07Z")

</div>

Dears Sirs,

I'm a recent user of Bro, so excuse me if this is a basic question...  
I need to find the exact meaning of each field of log files. For example, "duration is in seconds, miliseconds...?", "difference between orig\_bytes and orig\_ip\_bytes" and so on.

Still exist this information published in any place?

Thanks in advance!  
Best regards,  
Nuno.

---

<div class="post-metadata">

**Author:** ![Siwek\_Jon](https://avatars.discourse-cdn.com/v4/letter/s/90db22/32.png) [@Siwek\_Jon](https://community.zeek.org/u/Siwek_Jon)\
**Post date:** [September 4, 2013, 6:00pm UTC](https://community.zeek.org/t/specification-of-log-fields/2804/2 "2013-09-04T18:00:35Z")

</div>

> I need to find the exact meaning of each field of log files. For example, "duration is in seconds, miliseconds...?", "difference between orig\_bytes and orig\_ip\_bytes" and so on.

You can usually find descriptions if you browse the script reference documentation like at [1]. Generally, for fields of type "interval" (like "duration"), the unit is seconds.

- Jon

[1] [http://bro.org/sphinx/scripts/base/protocols/conn/main.html#type-Conn::Info](http://bro.org/sphinx/scripts/base/protocols/conn/main.html#type-Conn::Info)

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:41pm UTC](https://community.zeek.org/t/specification-of-log-fields/2804/3 "2022-05-06T15:41:12Z")

</div>


