# Write logs

**URL:** <https://community.zeek.org/t/write-logs/5182>\
**Category:** Zeek\
**Created:** [February 12, 2018, 4:04pm UTC](https://community.zeek.org/t/write-logs/5182 "2018-02-12T16:04:55Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rober\_Fernandez](https://avatars.discourse-cdn.com/v4/letter/r/eada6e/32.png) [@Rober\_Fernandez](https://community.zeek.org/u/Rober_Fernandez)\
**Post date:** [February 12, 2018, 4:04pm UTC](https://community.zeek.org/t/write-logs/5182/1 "2018-02-12T16:04:55Z")

</div>

I want to write several logs in the same connexion. The problem with logging framework is that only can filter a log;

For example, If i had three filters with log\_metadata= T, i would like to write in three differents logs

filter-1.log

filter-3.log

filter-10.log

function filter\_conn(id: Log::ID, path: string, rec: Conn::Info) : string {

local filters = Filter::filters;  
local file\_filter = “”;

for (i in filters) {

if (i?$log\_metadata && i$log\_metadata == T) {

file\_filter = “filter-” + cat(i$id\_fil);  
break;  
}  
}

return file\_filter;  
}

event bro\_init() {

local metadata: Log::Filter = [  
$name=“metadata”,  
$path=“metadata”,  
$include=set(“ts”,“id.orig\_h”, “id.orig\_p”, “id.resp\_h”, “id.resp\_p”, “proto”, “service”,  
“duration”, “orig\_bytes”, “resp\_bytes”, “missed\_bytes”, “orig\_pkts”, “resp\_pkts”, “orig\_file”,  
“resp\_file”),  
$path\_func=filter\_conn  
];

Log::add\_filter(Conn::LOG, metadata);

}

With this code, I only return the first match, filter-1.log

How could I do this?

Thanks

---

<div class="post-metadata">

**Author:** ![Azoff\_Justin\_S](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@Azoff\_Justin\_S](https://community.zeek.org/u/Azoff_Justin_S)\
**Post date:** [February 12, 2018, 4:11pm UTC](https://community.zeek.org/t/write-logs/5182/2 "2018-02-12T16:11:35Z")

</div>

The problem is that path\_func is not for filtering, it is for splitting a single log stream into one or more different output files.  
If you want to filter a log file, you need to use $pred, not $path\_func.

You simply need to call Log::add\_filter 3 times, once for each pred function.

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:45pm UTC](https://community.zeek.org/t/write-logs/5182/3 "2022-05-06T15:45:34Z")

</div>