# Working with tsv and json log files at the same time

**URL:** <https://community.zeek.org/t/working-with-tsv-and-json-log-files-at-the-same-time/6445>\
**Category:** Zeek\
**Created:** [January 26, 2022, 10:17am UTC](https://community.zeek.org/t/working-with-tsv-and-json-log-files-at-the-same-time/6445 "2022-01-26T10:17:52Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![clopmz](https://avatars.discourse-cdn.com/v4/letter/c/ebca7d/32.png) [@clopmz](https://community.zeek.org/u/clopmz)\
**Post date:** [January 26, 2022, 10:17am UTC](https://community.zeek.org/t/working-with-tsv-and-json-log-files-at-the-same-time/6445/1 "2022-01-26T10:17:52Z")

</div>

Hi all,

Just a quick question: is it possible to store Zeek’s log files in TSV and JSON formats at the same time, and storing in separate directories for each format?

Many thanks.

---

<div class="post-metadata">

**Author:** ![Ankith\_Kumar\_Hanuman](https://avatars.discourse-cdn.com/v4/letter/a/f04885/32.png) [@Ankith\_Kumar\_Hanuman](https://community.zeek.org/u/Ankith_Kumar_Hanuman)\
**Post date:** [January 26, 2022, 11:27am UTC](https://community.zeek.org/t/working-with-tsv-and-json-log-files-at-the-same-time/6445/2 "2022-01-26T11:27:57Z")

</div>

Hi Carlos,

Interesting question and I am also looking for the answer to your query.  
If anyone shares their answer then please let me know as well.

Thanks,  
Sami

---

<div class="post-metadata">

**Author:** ![Jan](https://avatars.discourse-cdn.com/v4/letter/j/ce7236/32.png) [@Jan](https://community.zeek.org/u/Jan)\
**Post date:** [January 26, 2022, 5:57pm UTC](https://community.zeek.org/t/working-with-tsv-and-json-log-files-at-the-same-time/6445/3 "2022-01-26T17:57:53Z")

</div>

Hi Carlos, hi Sami,

One of the following packages might help:  
[https://github.com/J-Gras/add-json](https://github.com/J-Gras/add-json)  
[https://github.com/corelight/json-streaming-logs](https://github.com/corelight/json-streaming-logs)

Jan

---

<div class="post-metadata">

**Author:** ![Darren\_S](https://avatars.discourse-cdn.com/v4/letter/d/59ef9b/32.png) [@Darren\_S](https://community.zeek.org/u/Darren_S)\
**Post date:** [January 26, 2022, 9:17pm UTC](https://community.zeek.org/t/working-with-tsv-and-json-log-files-at-the-same-time/6445/4 "2022-01-26T21:17:31Z")

</div>

This isn’t quite the answer Carlos is looking for, but just noting [https://github.com/corelight/json-streaming-logs](https://github.com/corelight/json-streaming-logs). It outputs logs into the same log output directory so these JSON logs exist alongside the TSV logs, but their naming makes them possible to match separately from the default logs.

If output to a specific directory were a requirement, I have the impression that might not be a difficult update to this package.

- Darren

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:47pm UTC](https://community.zeek.org/t/working-with-tsv-and-json-log-files-at-the-same-time/6445/5 "2022-05-06T15:47:50Z")

</div>