Skip site navigation (1)Skip section navigation (2)

FreeBSD Manual Pages

  
 
  

home | help
ZEEK-CUT(1)			 User Commands			   ZEEK-CUT(1)

NAME
       zeek-cut	- parse	Zeek logs

SYNOPSIS
       zeek-cut	[options] [columns]

DESCRIPTION
       Extracts	 the given columns from	ASCII Zeek logs	on standard input, and
       outputs them to standard	output.	 If no field names are given, all  are
       selected. By default, zeek-cut does not include format header blocks in
       the output.

       Columns	are  specified	as a list of space-separated field names.  The
       order of	field names given to zeek-cut  determines  the	output	order,
       which means zeek-cut can	be used	to reorder columns.

       The  ASCII  Zeek	 logs  read  on	standard input must have intact	format
       header blocks because zeek-cut needs this information to	correctly  in-
       terpret	the  log  file format.	In fact, zeek-cut can process the con-
       catenation of multiple ASCII log	files that have	different column  lay-
       outs.

OPTIONS
       -c     Include the first	format header block in the output.

       -C     Include all format header	blocks in the output.

       -m     Include  the  first format header	block in the output in minimal
	      view.

       -M     Include all format header	blocks in the output in	minimal	view.

       -d     Convert time values into human-readable format.

       -D <fmt>	Like -d, but specify format for	time (see strftime(3) for syn-
	      tax).

       -F <ofs>	Sets a different output	field separator	character.

       -h     Show help.

       -n     Print all	fields except those specified.

       -u     Like -d, but print timestamps in UTC instead of local time.

       -U <fmt>	Like -D, but print timestamps in UTC instead of	local time.

ENVIRONMENT
       ZEEK_CUT_TIMEFMT
	      For time conversion option -d or -u, the format  string  can  be
	      specified	by setting this	environment variable.

EXAMPLES
       Output three columns and	convert	time values:
       cat conn.log | zeek-cut -d ts id.orig_h id.orig_p

       Output all columns and convert time values with a custom	format string:
       cat conn.log | zeek-cut -D "%Y-%m-%d %H:%M:%S"

       Compressed logs must be uncompressed with another utility:
       zcat conn.log.gz	| zeek-cut

SEE ALSO
       strftime(3)

AUTHOR
       zeek-cut	was written by The Zeek	Project	<info@zeek.org>.

zeek-cut			 November 2014			   ZEEK-CUT(1)

Want to link to this manual page? Use this URL:
<https://man.freebsd.org/cgi/man.cgi?query=zeek-cut&sektion=1&manpath=FreeBSD+Ports+14.3.quarterly>

home | help