[Bro] Changing separator
James Lay
jlay at slave-tothe-box.net
Thu Oct 24 08:10:00 PDT 2013
So...I'm almost certain that there was a way to change from the tab
character, to comma (I thought), but for the life of me I can't seem to
find it. Been working with logstash and currently messages come through
as:
1382627138.211512\tCQ74U23HZlcab0LNnh\t192.168.1.3\t64079\t224.0.0.1\t8612\tudp\t-\t-\t-\t-\tS0\tT\t0\tD\t1\t44\t0\t0\t(empty)
Which is kind of painful for matching. Any quick pointers on how to do
this? Thank you.
James
More information about the Bro
mailing list