Zeek and json output question

Zeek
1

Hi All-

I want to run a test, but I don’t want to use all my zeek cluster data. I do know how to output all my zeek logs in JSON output, but how can I output just a single log to JSON output (like the ftp.log)?

What I’m looking for: All the zeek logs output like normal (tab separated), PLUS the FTP log is output in JSON format as well. Can I break one out or is it all or nothing?

Thank you,

-Brian

2

Yep! Give this a try

event zeek_init()
{
Log::add_filter(FTP::LOG, [
$name = “ftp-json”,
$path = “ftp_json”,
$config = table([“use_json”] = “T”)
]);
}

This package does this in a bit more advanced way:

https://github.com/J-Gras/add-json

3

If you want to use that package, the following enables JSON for FTP only:

redef Log::enable_all_json = F;
redef Log::include_json += {FTP::LOG};

Jan