Store ASCII and JSON output format at the same time

Zeek
1

Hi Bro Family,

We want to implement a logging configuration with Bro that will allow us to store the output in both formats at the same time: JSON and ASCII.

The main idea is to have something like:
.- weird.log
.- weird.json

As each filter seems to be able to use one writer, I can’t see the way to accomplish this configuration with current plugins, configs, packets. Hopefully, I’m wrong.

Does someone know if there is a configuration or packet that can help to achieve this config?

2

There is a package that provides more or less exactly this
functionality: https://github.com/J-Gras/add-json

If you have installed the Bro Package Manager:
bro-pkg install add-json

Jan

3

Thanks Jan,

Will check it right now.

4

Tested… it works. Thanks