files-split-certs.bro

event bro_init()
{
    Log::remove_default_filter(Files::LOG);
    Log::add_filter(Files::LOG, [
        $name = "files-split",
        $path_func(id: Log::ID, path: string, rec: Files::Info) = {
            if (rec?$mime_type && rec$mime_type == "application/pkix-cert")
                return "files_certs";
            return "files";
        }
    ]);
}