ZEEK-CUT(1) User Commands ZEEK-CUT(1) NAME zeek-cut - parse Zeek logs SYNOPSIS zeek-cut [options] [columns] DESCRIPTION Extracts the given columns from ASCII Zeek logs on standard input, and out- puts them to standard output. If no field names are given, all are se- lected. By default, zeek-cut does not include format header blocks in the output. Columns are specified as a list of space-separated field names. The order of field names given to zeek-cut determines the output order, which means zeek-cut can be used to reorder columns. The ASCII Zeek logs read on standard input must have intact format header blocks because zeek-cut needs this information to correctly interpret the log file format. In fact, zeek-cut can process the concatenation of multi- ple ASCII log files that have different column layouts. OPTIONS -c Include the first format header block in the output. -C Include all format header blocks in the output. -m Include the first format header block in the output in minimal view. -M Include all format header blocks in the output in minimal view. -d Convert time values into human-readable format. -D <fmt> Like -d, but specify format for time (see strftime(3) for syntax). -F <ofs> Sets a different output field separator character. -h Show help. -n Print all fields except those specified. -u Like -d, but print timestamps in UTC instead of local time. -U <fmt> Like -D, but print timestamps in UTC instead of local time. ENVIRONMENT ZEEK_CUT_TIMEFMT For time conversion option -d or -u, the format string can be speci- fied by setting this environment variable. EXAMPLES Output three columns and convert time values: cat conn.log | zeek-cut -d ts id.orig_h id.orig_p Output all columns and convert time values with a custom format string: cat conn.log | zeek-cut -D "%Y-%m-%d %H:%M:%S" Compressed logs must be uncompressed with another utility: zcat conn.log.gz | zeek-cut SEE ALSO strftime(3) AUTHOR zeek-cut was written by The Zeek Project <info@zeek.org>. zeek-cut November 2014 ZEEK-CUT(1)
NAME | SYNOPSIS | DESCRIPTION | OPTIONS | ENVIRONMENT | EXAMPLES | SEE ALSO | AUTHOR
Want to link to this manual page? Use this URL:
<https://man.freebsd.org/cgi/man.cgi?query=zeek-cut&sektion=1&manpath=FreeBSD+Ports+15.1.quarterly>