Extract Specific Columns From Zeek Logs
zcutter is a program that processes Zeek logs much like the existing zeek-cut program and extends it. Like zeek-cut, zcutter can pull out specific fields from TSV-format zeek log files. zcutter goes beyond this to work with json/ndjson log files as well.
- Command line option-compatible with zeek-cut.
- Reads and writes both TSV and ndjson/json formatted zeek log files. All can be uncompressed, gzip-compressed, or bzip2-compressed.
- Converts from one to the other on the fly.
- Can accept multiple input log files. Optionally, it can write the converted log files out to a destination directory, allowing you to bulk convert an entire directory of log files at once.
zcutter is available at GitHub: https://github.com/activecm/zcutter