# The right way to disable bro write local file and enable elasticsearch

**URL:** <https://community.zeek.org/t/the-right-way-to-disable-bro-write-local-file-and-enable-elasticsearch/3612>\
**Category:** Zeek\
**Created:** [May 21, 2015, 9:59am UTC](https://community.zeek.org/t/the-right-way-to-disable-bro-write-local-file-and-enable-elasticsearch/3612 "2015-05-21T09:59:09Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mo\_Jia](https://avatars.discourse-cdn.com/v4/letter/m/57b2e6/32.png) [@Mo\_Jia](https://community.zeek.org/u/Mo_Jia)\
**Post date:** [May 21, 2015, 9:59am UTC](https://community.zeek.org/t/the-right-way-to-disable-bro-write-local-file-and-enable-elasticsearch/3612/1 "2015-05-21T09:59:09Z")

</div>

I add redef Log::enable\_local\_logging = F; the elasticsearch can't  
work , I think the reason is in this func:

WriterFrontend::WriterFrontend(const WriterBackend::WriterInfo&  
arg\_info, EnumVal\* arg\_stream, EnumVal\* arg\_writer, bool arg\_local,  
bool arg\_remote)  
&nbsp;&nbsp;&nbsp;{

&nbsp;&nbsp;&nbsp;// comment

&nbsp;&nbsp;&nbsp;if ( local )  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;backend = log\_mgr-\>CreateBackend(this, writer);

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if ( backend )  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;backend-\>Start();  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}

&nbsp;&nbsp;&nbsp;else  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;backend = 0;  
&nbsp;&nbsp;&nbsp;}

I know the ascii writer and elasticsearch plugin are both like a  
filter on a stream. I want to know the right way to disable the asscii  
writer?

Is there somethings like a single var I can redef such as  
enable\_ascii\_logging ,

event bro\_init() &priority=5  
{  
Log::create\_stream(HTTP::LOG, [$columns=Info, $ev=log\_http, $path="http"]);  
Analyzer::register\_for\_ports(Analyzer::ANALYZER\_HTTP, ports);  
}

This may create the stream and default make http.log can be create.

---

<div class="post-metadata">

**Author:** ![Mo\_Jia](https://avatars.discourse-cdn.com/v4/letter/m/57b2e6/32.png) [@Mo\_Jia](https://community.zeek.org/u/Mo_Jia)\
**Post date:** [May 21, 2015, 10:19am UTC](https://community.zeek.org/t/the-right-way-to-disable-bro-write-local-file-and-enable-elasticsearch/3612/2 "2015-05-21T10:19:38Z")

</div>

And it seem that in frameworks/logging/man.bro. Everytime it create stream.

function add\_default\_filter(id: ID) : bool  
{  
return add\_filter(id, [$name="default"]);  
}

this line auto create a Log::WRITER\_ASCII to stream.

I am looking for a scripts-method to disable ascii log and enable  
other writer. ( don't want change any c++ file in bro)  
Does I need comment this line. If in this way every time I install  
new bro, I should change it .

---

<div class="post-metadata">

**Author:** ![Daniel\_Thayer](https://avatars.discourse-cdn.com/v4/letter/d/8dc957/32.png) [@Daniel\_Thayer](https://community.zeek.org/u/Daniel_Thayer)\
**Post date:** [May 21, 2015, 5:00pm UTC](https://community.zeek.org/t/the-right-way-to-disable-bro-write-local-file-and-enable-elasticsearch/3612/3 "2015-05-21T17:00:29Z")

</div>

Have you tried removing the default filter?

event bro\_init()  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Log::remove\_filter(HTTP::LOG, "default");  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}

---

<div class="post-metadata">

**Author:** ![Mo\_Jia](https://avatars.discourse-cdn.com/v4/letter/m/57b2e6/32.png) [@Mo\_Jia](https://community.zeek.org/u/Mo_Jia)\
**Post date:** [May 22, 2015, 2:59am UTC](https://community.zeek.org/t/the-right-way-to-disable-bro-write-local-file-and-enable-elasticsearch/3612/4 "2015-05-22T02:59:01Z")

</div>

Thanks .

Using this code success get my wish.

event bro\_init() &priority=-5  
{  
for ( stream\_id in Log::active\_streams )  
{  
&nbsp;&nbsp;&nbsp;Log::remove\_filter(stream\_id, "default");  
}  
}

by the way,  
#:/usr/local/bro/logs/current$ ls  
debug.log packet\_filter.log stderr.log stdout.log

These logs can't remove by this way.

---

<div class="post-metadata">

**Author:** ![Daniel\_Thayer](https://avatars.discourse-cdn.com/v4/letter/d/8dc957/32.png) [@Daniel\_Thayer](https://community.zeek.org/u/Daniel_Thayer)\
**Post date:** [May 22, 2015, 3:55pm UTC](https://community.zeek.org/t/the-right-way-to-disable-bro-write-local-file-and-enable-elasticsearch/3612/5 "2015-05-22T15:55:28Z")

</div>

The reason why you are seeing the packet\_filter.log is  
because it gets created before you remove its default filter.  
To prevent the log file from being created, try removing the  
"&priority=-5" on your bro\_init event handler.

The reason why you are seeing those other files is because they  
are not created by the logging framework (e.g., stdout.log/stderr.log  
are created by broctl).

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:42pm UTC](https://community.zeek.org/t/the-right-way-to-disable-bro-write-local-file-and-enable-elasticsearch/3612/6 "2022-05-06T15:42:41Z")

</div>