hello everyone! I read that zeek can also output log files in json format, instead of the standard output format. Can you help me setting this option? Thanks!
Hi there!
zkg install add-json should do all you need — take a look here: GitHub - J-Gras/add-json: Enables additional JSON-logging for Zeek.
You may need to say zkg install --version master add-json to pull in some recent fixes if you get a message around failing tests, depending on your Zeek version.
For more low-level configuration, you can also simply @load tuning/json-logs, or redef LogAscii::use_json=T.
Hope this helps,
Christian
1 Like
I tried both the zkg install and the low level one but none of them worked. For the low level, should I modify the local.zeek file right?
For the low level, should I modify the local.zeek file right?
Yeah. If you’re running Zeek via zeekctl, remember to do a zeekctl deploy after making changes.
For basic testing you can also try things like zeek -r some.pcap tuning/json-logs or zeek -r some.pcap LogAscii::use_json=T.
Best,
Christian
1 Like
Thank you! I solved it
1 Like