[Bro] Changing separator

James Lay jlay at slave-tothe-box.net
Thu Oct 24 08:41:49 PDT 2013


On 2013-10-24 09:10, James Lay wrote:
> So...I'm almost certain that there was a way to change from the tab
> character, to comma (I thought), but for the life of me I can't seem 
> to
> find it.  Been working with logstash and currently messages come 
> through
> as:
>
> 
> 1382627138.211512\tCQ74U23HZlcab0LNnh\t192.168.1.3\t64079\t224.0.0.1\t8612\tudp\t-\t-\t-\t-\tS0\tT\t0\tD\t1\t44\t0\t0\t(empty)
>
> Which is kind of painful for matching.  Any quick pointers on how to 
> do
> this?  Thank you.
>
> James

Thanks for the responses gents...every little bit helps.

James




More information about the Bro mailing list