GSP
Quick Navigator

Search Site

Unix VPS
A - Starter
B - Basic
C - Preferred
D - Commercial
MPS - Dedicated
Previous VPSs
* Sign Up! *

Support
Contact Us
Online Help
Handbooks
Domain Status
Man Pages

FAQ
Virtual Servers
Pricing
Billing
Technical

Network
Facilities
Connectivity
Topology Map

Miscellaneous
Server Agreement
Year 2038
Credits
 

USA Flag

 

 

Man Pages
ZEEK-CUT(1) User Commands ZEEK-CUT(1)

zeek-cut - parse Zeek logs

zeek-cut [options] [columns]

Extracts the given columns from ASCII Zeek logs on standard input, and outputs them to standard output. If no field names are given, all are selected. By default, zeek-cut does not include format header blocks in the output.

Columns are specified as a list of space-separated field names. The order of field names given to zeek-cut determines the output order, which means zeek-cut can be used to reorder columns.

The ASCII Zeek logs read on standard input must have intact format header blocks because zeek-cut needs this information to correctly interpret the log file format. In fact, zeek-cut can process the concatenation of multiple ASCII log files that have different column layouts.

-c
Include the first format header block in the output.
-C
Include all format header blocks in the output.
-d
Convert time values into human-readable format.

-D <fmt> Like -d, but specify format for time (see strftime(3) for syntax).

-F <ofs> Sets a different output field separator character.

-h
Show help.
-n
Print all fields except those specified.
-u
Like -d, but print timestamps in UTC instead of local time.

-U <fmt> Like -D, but print timestamps in UTC instead of local time.

ZEEK_CUT_TIMEFMT
For time conversion option -d or -u, the format string can be specified by setting this environment variable.

Output three columns and convert time values:
cat conn.log | zeek-cut -d ts id.orig_h id.orig_p

Output all columns and convert time values with a custom format string:
cat conn.log | zeek-cut -D "%Y-%m-%d %H:%M:%S"

Compressed logs must be uncompressed with another utility:
zcat conn.log.gz | zeek-cut

strftime(3)

zeek-cut was written by The Zeek Project <info@zeek.org>.
November 2014 zeek-cut

Search for    or go to Top of page |  Section 1 |  Main Index

Powered by GSP Visit the GSP FreeBSD Man Page Interface.
Output converted with ManDoc.