hello everyone! I read that zeek can also output log files in json format, instead of the standard output format. Can you help me setting this option? Thanks!
zkg install add-json should do all you need — take a look here: GitHub - J-Gras/add-json: Enables additional JSON-logging for Zeek.
You may need to say
zkg install --version master add-json to pull in some recent fixes if you get a message around failing tests, depending on your Zeek version.
For more low-level configuration, you can also simply
@load tuning/json-logs, or redef
Hope this helps,
I tried both the zkg install and the low level one but none of them worked. For the low level, should I modify the local.zeek file right?
For the low level, should I modify the local.zeek file right?
Yeah. If you’re running Zeek via
zeekctl, remember to do a
zeekctl deploy after making changes.
For basic testing you can also try things like
zeek -r some.pcap tuning/json-logs or
zeek -r some.pcap LogAscii::use_json=T.
Thank you! I solved it