json-streaming-logs
json-streaming-logs copied to clipboard
corelight
Bro script package to create JSON formatted logs to stream into data analysis systems.
Running the default zeek image and the json-streaming-logs package results in an error logged. I do not know if this is a docker issue, zeek issue, or something that can...
https://github.com/corelight/json-streaming-logs/blob/4616cab465379c0f03807ebacc6ddf3701cb9703/scripts/main.zeek#L46 When running this script on a PCAP, the value for `_write_ts` will be the timestamp from the time of the packet in the PCAP and not the current time...
Any interest in a PR for an optional binary format like https://amzn.github.io/ion-docs or JSONB to reduce bandwidth? Zstandard/Parquet aggregation is probably out of scope because that would be the job...
