1BRO-CUT(1)                       User Commands                      BRO-CUT(1)
2
3
4

NAME

6       bro-cut - parse Bro logs
7

SYNOPSIS

9       bro-cut [options] [columns]
10

DESCRIPTION

12       Extracts  the  given columns from ASCII Bro logs on standard input, and
13       outputs them to standard output.  If no  columns  are  given,  all  are
14       selected.  By default, bro-cut does not include format header blocks in
15       the output.
16
17       Columns are specified as a list of space-separated  field  names.   The
18       order  of  field  names  given  to bro-cut determines the output order,
19       which means bro-cut can be used to reorder columns.
20
21       The ASCII Bro logs read on  standard  input  must  have  intact  format
22       header  blocks  because  bro-cut  needs  this  information to correctly
23       interpret the log file format.  In fact, bro-cut can process  the  con‐
24       catenation  of multiple ASCII log files that have different column lay‐
25       outs.
26

OPTIONS

28       -c     Include the first format header block into the output.
29
30       -C     Include all format header blocks into the output.
31
32       -d     Convert time values into human-readable format.
33
34       -D <fmt> Like -d, but specify format for time (see strftime(3) for syn‐
35              tax).
36
37       -F <ofs> Sets a different output field separator.
38
39       -n     Print all fields except those specified.
40
41       -u     Like -d, but print timestamps in UTC instead of local time.
42
43       -U <fmt> Like -D, but print timestamps in UTC instead of local time.
44

ENVIRONMENT

46       BRO_CUT_TIMEFMT
47              For  time  conversion  option -d or -u, the format string can be
48              specified by setting this environment variable.
49

EXAMPLES

51       Output three columns and convert time values:
52       cat conn.log | bro-cut -d ts id.orig_h id.orig_p
53
54       Output all columns and convert time values with a custom format string:
55       cat conn.log | bro-cut -D "%Y-%m-%d %H:%M:%S"
56

SEE ALSO

58       strftime(3)
59

AUTHOR

61       bro-cut was written by The Bro Project <info@bro.org>.
62
63
64
65bro-cut                          November 2014                      BRO-CUT(1)
Impressum