Re: Field renaming
Vlad Grigorescu <[email protected]>
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <CAPqbkwuNfoqT8KDZONxsJho=G4pyZQkiPOCHRnFjiivpcHVnTw@mail.gmail.com> |
Are you using JSON logs? I think JSON logs use an underscore because the dot notation conflicts with a JSON object. On Wed, Jun 12, 2019 at 1:05 PM Justin Azoff <[email protected]> wrote: > On Wed, Jun 12, 2019 at 2:30 AM David Decker <[email protected]> wrote: > > > > Zeek > > > > Sorry cant find this, but when did id_resp_h become id.resp_h? > > And well for the rest (renamed _ to . ) > > Looked through changelog. > > It has always been id.resp_h, you must have had this in your > configuration at one point: > > redef Log::default_scope_sep = "_"; > > > -- > Justin > _______________________________________________ > Zeek mailing list > [email protected] > http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek > _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek