# Zeek and json output question

**URL:** <https://community.zeek.org/t/zeek-and-json-output-question/5974>\
**Category:** Zeek\
**Created:** [January 23, 2020, 9:35pm UTC](https://community.zeek.org/t/zeek-and-json-output-question/5974 "2020-01-23T21:35:44Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Allen\_Brian](https://avatars.discourse-cdn.com/v4/letter/a/73ab20/32.png) [@Allen\_Brian](https://community.zeek.org/u/Allen_Brian)\
**Post date:** [January 23, 2020, 9:35pm UTC](https://community.zeek.org/t/zeek-and-json-output-question/5974/1 "2020-01-23T21:35:44Z")

</div>

Hi All-

I want to run a test, but I don’t want to use all my zeek cluster data. I do know how to output all my zeek logs in JSON output, but how can I output just a single log to JSON output (like the ftp.log)?

What I’m looking for: All the zeek logs output like normal (tab separated), PLUS the FTP log is output in JSON format as well. Can I break one out or is it all or nothing?

Thank you,

-Brian

---

<div class="post-metadata">

**Author:** ![JustinAzoff](https://avatars.discourse-cdn.com/v4/letter/j/13edae/32.png) [@JustinAzoff](https://community.zeek.org/u/JustinAzoff)\
**Post date:** [January 23, 2020, 10:47pm UTC](https://community.zeek.org/t/zeek-and-json-output-question/5974/2 "2020-01-23T22:47:46Z")

</div>

Yep! Give this a try

event zeek\_init()  
{  
Log::add\_filter(FTP::LOG, [  
$name = “ftp-json”,  
$path = “ftp\_json”,  
$config = table([“use\_json”] = “T”)  
]);  
}

This package does this in a bit more advanced way:

[https://github.com/J-Gras/add-json](https://github.com/J-Gras/add-json)

---

<div class="post-metadata">

**Author:** ![Jan](https://avatars.discourse-cdn.com/v4/letter/j/ce7236/32.png) [@Jan](https://community.zeek.org/u/Jan)\
**Post date:** [January 24, 2020, 9:34am UTC](https://community.zeek.org/t/zeek-and-json-output-question/5974/3 "2020-01-24T09:34:30Z")

</div>

If you want to use that package, the following enables JSON for FTP only:

redef Log::enable\_all\_json = F;  
redef Log::include\_json += {FTP::LOG};

Jan

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:47pm UTC](https://community.zeek.org/t/zeek-and-json-output-question/5974/4 "2022-05-06T15:47:00Z")

</div>