Skip to content

Instantly share code, notes, and snippets.

@jayswan jayswan/add-json.bro forked from J-Gras/add-json.bro
Created Apr 28, 2016

Embed
What would you like to do?
Additional JSON logging for Bro.
# Add additional JSON logging
module Log;
export {
## Enables JSON-logfiles for all active streams
const enable_all_json = T &redef;
## Streams not to generate JSON-logfiles for
const exclude_json: set[Log::ID] = { } &redef;
## Streams to generate JSON-logfiles for
const include_json: set[Log::ID] = { } &redef;
## Path to the additional JSON-logfiles
const path_json = "" &redef;
## Rotation interval for JSON-logfiles
const interv_json = default_rotation_interval &redef;
## Format of timestamps for JSON-logfiles.
## See: :bro:see:`LogAscii::json_timestamps`
const timestamps_json = "JSON::TS_MILLIS" &redef;
}
event bro_init()
{
const config_json = table(
["use_json"] = "T",
["json_timestamps"] = timestamps_json);
# Add filter for JSON output
for ( id in Log::active_streams )
{
if ( (enable_all_json || (id in include_json)) && (id !in exclude_json) )
{
local filter = Log::get_filter(id, "default");
filter$name = string_cat(filter$name, "_json");
filter$path = string_cat(path_json, filter$path, "-json");
filter$config = config_json;
filter$interv = interv_json;
Log::add_filter(id, filter);
}
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.