Zeek turns packets into structured logs. By default, Zeek
generates one file per log type and per rotation timeframe. If you don't want to
wrangle files and directly process the output, this short blog post is for you.
eyJ2ZXJzaW9uIjoiMSIsImVuY29kaW5nIjoiYnN0cmluZyIsImNvbXByZXNzZWQiOnRydWUsImVuY29kZWQiOiJ4nL1Z23bqSJJ9r684y/NY3ad0XHUwMDA1VPOEXHUwMDExxjpNXG5jwLaY1Vx1MDAwZpLAsiRuy1x1MDAxMujSU58y3zD/1F/SO1wiJcCuU7Vq1poun+WDlcpLROTeO1wik3/88OXLTV5cdTAwMWTWNz9/uVmXob+JV+9+cfNcdTAwMTdqP63fs3i/wyuNn7P98T3knm95fsh+/ukn/3D4elx1MDAxOfU13G/lyPVmvV3v8lxmff9cdTAwMGLPX778g//Hm3hF41x1MDAwM7+8N6cv/frhr7fdcDp9UHrpI1x1MDAwZuVOrUH5uswvrSWa/qp3XGbl3FJRi9a5NFx1MDAxNPEqf0OjYfQujW/rOHrLyVx1MDAwYsv82lV6WlfXzJ6hd61zXHUwMDE3f1x1MDAxN21oxcugLH/fp+vBfrN/J0v+Q+GfizGBXHUwMDFmptH7/rhbXfr45qr3+nrp81x1MDAxYW82s7zayJD54dvxfX3zaYXnxmLtU/t5XFy2R3Avo7Bk9LZbZ1x1MDAxNFr13Lo/+GGcUzhU5eJcdTAwMDPZd3BWvFx1MDAwYn+/WPXub9dcdTAwMGVtw+642VxcT7xbNVx1MDAxM394ka3X1Fk3urqldM/NV+DQ1M+t7n7HQFF7itLrdvTepUec2UBHznO++ptsfVx0KVkwvCDng1x1MDAxNcfDypeD1E7PUoyu1rWsnnF+v4l36ecxm32YfmdcdTAwMWRGXHUwMDE1XCL7z//53y/HXHUwMDAzwr32t1/+W77E52pf7GTj1U7ud/ksrsklzeh8NTTd7KiK0etYPe1Dpzt/XHUwMDFib2hcdTAwMWb0XHUwMDBmy/U3cUShulx04dv6/eY6XnlcZv6cO+T7wzXIsjVcdTAwMWPjZfXeV+X6p3PuXHUwMDE1Yl1cdTAwMWa93n+9qfv3OIp3/mb+f3eZ1r1vmaN+1a428I5cdTAwMTDk4rdcci2/+uUvXHUwMDFmmd6SON760frmO7jpdIzfxI2uaabVMXTzXHUwMDBm4EZKSrHaO6l1eFxc9V/uulx1MDAwZnZiXHUwMDFllHjxXHUwMDFiXFz8xKmPTFT/XHJM/LW+sJipve6FUFLMjN+UoPzd32VcdTAwMDf/XHUwMDFkXGL6fVx1MDAxOXp99S3jytBWXHUwMDE0Le07mqgrylete/3zmfhaT9H0jq5f1PL/R1c+0/1qql+T3bJcZs28xuZcdTAwMWYle5b7+THj7fNP69VcdTAwMDdASGtvzF5Hf1XCIPBfe72w01EsXdNXr1i0s1JeVdWwumtLXHJU7VX3XHUwMDAz0N5cbo3u2njtdFbd4FXr4r2x0sJud919XHJcdTAwMDNdeVxyNKWnr8OVXHUwMDFlvKqK2u1dXHUwMDAxXHJMX59zXCL9nIGDP5u//i7ZhP85IDfIsTM4QeMkt25O8bq4/e7G08/NXHUwMDBmXHJcdTAwMTfZxewy7N/u589cdTAwMTfyb+Pten4tXHUwMDAwP2Wn6Mdyu7n5RNs/L/iAlL94XHUwMDFj06L0589cdTAwMWbM+k+SWujRw72rLatbI3guj2F9OFx1MDAwNNu89rS7YjlXYv/+UVx07f1prK/0VWVe3s3MU7hcck/B9i5fvriF9+xuwsq6eu9E65GaXHUwMDA1O9FcdDUr9V9uT8tRajnbN2V13++MK6tcdTAwMGW0x0M4wruZWVx1MDAwN/pT5WlP20D/tsPcx+XL9PR49zhcdTAwMWPrLsZtXG7qO573j8v7x9SJW1t/ZZ8uKmmXSPqFXHUwMDE4WPVqXHUwMDFixs79W1x1MDAxZYzMerKDn394zHJcdTAwMTPu3EOgXHUwMDE5lpNcZo9cdTAwMDL++M9Ty+E5XHUwMDFjvF9cdTAwMWRgy/5h5pSuPY2d0dvGf17tV7ZcdTAwMTK7dnhcdTAwMTTzvuYmnlx1MDAwZVs1//lJn24tXHUwMDAzfVx1MDAwYsfuR2I+VVx1MDAxY3uqj5NhgT6aWznRVYw6y5GVcFxcXHUwMDEx//X2aeOrVlx1MDAxY4zuXHUwMDEyfO5cdTAwMTGfw3prXHUwMDFkV6O7bLx9KsLK+XFcdTAwMTD3o4fR42a5XHUwMDEz0sYt/605cU++u7/EcLI134Lnp3S13WxW1e1hXHR7ea3nR7bTXHUwMDFkwJbR3W757J6CkVXB5mS5lf/gS4z10+XLtyTQylOYKLFTI2Y2xc2JvK1VLUdPVaDfvnnaRlnDfjEwKpdjZ76HmvtcdTAwMTaOXHUwMDE2wMPbaYU+S+2p9kd3aaCHiDFiOtpcdTAwMWN9XHUwMDFkXHUwMDExebndTHb8/lx1MDAxNJLfL48mxW6c9L/XJ/FH+NWAn631XHUwMDE2buH/536IR6jlXHUwMDE3m7VpubTvUuzp6SHaR45d7tA/fZh9201cdTAwMDZcdTAwMWZtXerfTquX21x1MDAxY7Hb4H3mvWw2QMeHPtibePlcXCDuWFO1Nuv7x9fnuzePflx1MDAxMTMl3N5cdTAwMWRDbVx0jCnoo76t7rGHg6hcdTAwMWMnom7+ZWJQXHUwMDE044HyuU1xK6NcdTAwMTQ2MJKEXHUwMDA3JzH+5lxm+lx1MDAxZuxcdTAwMDXOgMXHyns26yXiXHUwMDFmIOZkVzBa7Fx1MDAxMfvybzOJj2ZcXOG9PO6dXHUwMDExYUSJRFwilHFcdTAwMTKablWUbrI4TuZO5YxENJ5cdTAwMGaPbpJWY5s++6UzUNBvaLiDosJcdTAwMWWoYtbP3dioRVx1MDAxMmViXHUwMDA2+5JcdTAwMDXGOMD8tIRcdTAwMGbYp7TGmHqcLKrJoMhFZVx1MDAxNFwiXHTRR1x1MDAxY925Y6CPXG4/NVHdZuBcdTAwMDHW8KitnlxmXGbTnU9pfbxcdTAwMGY1MStKmsNcdTAwMWTcJlx1MDAwZc87XHUwMDA0lopC/u3U9Dfs0dy4n8PXXHUwMDFhcyNmXHUwMDA2cSqaXHL6ZNfRtUVcdTAwMTRcZvom7NTFfJghXuDdXCLyqj75oo9th/qAj/icXHUwMDBic2wjXHUwMDBl9jRcIr8m8zSDTTrNQTHBnmjUf2KneJ5cdTAwMWVcdTAwMTE/Y0z211NccjZh3mkl4oJiqrjxrePYw1JcXGyvXHUwMDEx59Z21aW4kK31MFwiXVx1MDAxM3VqyNj19clcZnFcdTAwMTkoXHUwMDE1bKjxXkV71cQrkXF1amEv4Cv2YWZcdTAwMTii9jKKP/bKdDi2Ue3GXHUwMDA1v0Ps2lx1MDAxOCuIZy7qIeyHLsFeXHUwMDExXHUwMDFiwFx1MDAxNfbM9mCzozt2WPE+14vMTVx1MDAwNPpccjXoXHUwMDE1xobqhPCZePBcdTAwMDFrXHUwMDBlMK5OddozQWvUXHUwMDFjT8Iv2VZcdI6tV7q1XHUwMDAzu2Q8pZ2pKfc+UpxRXHUwMDA0/PXRP7r2XHUwMDE3Wlx1MDAxMpEvXHUwMDFh+SixXGJcXNlDU8ZgUVxu2uuZoVx0O0U/XHUwMDBmmEsrsnFcdTAwMDK9RVx1MDAxZlx1MDAwM+Ncblx1MDAxN3tPcXRnXHUwMDFjY4NiXGZfazehubGPSWQ6NrCYTFXJOceYzGhMWFxuwlx1MDAxN72zMVx1MDAxZvlcdTAwMGXf4K/qzoH1mDDhXHUwMDExnoBr2EBtNTBWXHUwMDBmXHUwMDE1slx1MDAxNXYp4CpxQkd/etY4luChm8CGgcSgS/NcZlx1MDAxOLOmW4c0L/gxZX5cYlx1MDAxYvzA+tinWu6lXHUwMDAzTS5cdTAwMTAnUWL/gamU9kqbzFx1MDAxN2RcdTAwMDf+hjbYwHWdXHUwMDAyv6ncXHUwMDA3YFx1MDAxNFitXHUwMDFjqSdcdTAwMDb2j2xQ0K/lYI05iYM6cZn8cu1IXHUwMDFkc1x1MDAxY4eG5LvH8Vx1MDAxMjQuiVwijnXtXHUwMDE4wHfecn4+YFx1MDAwZSEmi1x1MDAxYWtcIo9ij+1FNKX9l8/6ZI64xEXl1li3XHUwMDBla3BcdTAwMDJrRFx1MDAwNXJkXHUwMDA2TYBfoSr3K9Jo/mZcdTAwMWN84vjpwlx1MDAwZVx1MDAwYlE141x0340muXOvXHUwMDE5PzUkpzzSXHUwMDA29Fx1MDAxYpJcdTAwMGU1bVx1MDAwYrZNUHtcdTAwMTJiT6cqr287ikigXHUwMDE1iacyzoZFNLEjtEdcdTAwMWFp4YTyd70wmz1FrKGFXHUwMDFjS69AvEhcdTAwMGLhV5hJbFx1MDAwMlx1MDAxZlJcdTAwMGJL2Yc0iuIyVCbMUcNcdTAwMTSEhcpQMWfFe4s9ZozNhYrYsFx1MDAxNjJPZdx1xlpccntgO+yl9zVixtilfWK7kFeFLTLWXHUwMDBlu69cdTAwMTNcdTAwMDcwppZcdTAwMWEyLF3CQbIwSFx1MDAwNyhcdTAwMGaIeVx1MDAxOPmDvlx1MDAwMTtK4iOwk09ovrpPPEaOQXxmrC+si3iWmmI7pmxbKKKenvkseYRYMOdCaHefc1x1MDAxN69cdTAwMTdcdTAwMWJcdTAwMDbmJt5UwGVGWslcdTAwMWFJa9hcdTAwMGXFstXIPfwrWFx1MDAxYoBNxi7p34A42Kd9NFx0k/DT5GdwQT5Pdefei1x1MDAxYd9ccmdUQEvIXHUwMDE3R5N63uc8XHUwMDA2X7E+6yRpXHUwMDBlxVrqUnV+Zi2aXFxiT9xjLKJPq4+kM1xy58hvqZHAZN5qpCu53PQlvVx1MDAxNNqk5WZVfNRI2n9oJOkozVx1MDAwZruzVlx1MDAxYlvtnsxcbvlcdD4jj9F42n+l9Vx1MDAxMz5Tn1xuuKswl8a+koaAu+z/fGhcIidcdTAwMTJeS6ojWG/mnJMpN2Ovh5TXKvSX+2hHXHUwMDE1c98m/WO7kEuhMzZrpdRcXMnJj21tTlx1MDAxZPB7XHUwMDA1ubWS+Fx1MDAwYolfnCPB04p1mGywQ5W4JuZNzrdcdTAwMTeIUVqRVnpcdTAwMTXPR/pZS1x1MDAxZUFcdTAwMTfqqKlFuEbJpY72K+lcdTAwMDd0gfNcdTAwMGLlXHUwMDAwek/YSWFj2vCS9JLyXHUwMDBiaVx1MDAwNWGZNZW4SZxn7b60ka461YTWT1jfOcdx7cK6XHUwMDFhmeBym+MqrtGQu0hLwDld4nmqUP3T8rqpcVx1MDAxMJ++6Vx1MDAwZVx1MDAxYT2Q+chke5OU+IH9TyVmbFx1MDAwZlx1MDAxOJmanG9YT4ZtbYWcyHw1UFx1MDAwYlx1MDAxNoiDjk/KaSXXRbbkgORcdTAwMDX2fcZcdTAwMWMqZL4mnPBzRbVcdTAwMDc+WctcdTAwMWI9yJrPSnIrVHiO+Vx1MDAwMnVcdTAwMDaNXHUwMDExpuD6yjGQL1xiX8BLSrlcbrUpP5eUg13CXb0or2oyysEqYXU8R2xQL8KW1uZcbvVwvbrfZHS2WW43WWDvXHUwMDEzYKjwoO1cdTAwMTNteVxiRkV+OT/sy7Yt3D1hzOFcdTAwMThoZlx1MDAwN+eP00R3UVdb703bXHUwMDA28/JZXHUwMDA251x1MDAwNcW3aZ3e9+veVIngXHUwMDBmYVx1MDAwNVx1MDAxYyngw1x1MDAwMnFLXHUwMDE1Z1x1MDAxOEXQXHLSdo15RlxcSlwiql+RXHUwMDFih5wzJc9IQ4SCPa2bOCufnsnnivSJalLK62fe1zLHXHUwMDAz+1x1MDAxNDfSiNwlXtXtM+FcdTAwMTBx55ybSk5Uhjnhupb71lx1MDAxMvPtXFwh5/kx155sQyGx2C+kPUK5eqczbqkuxDzIhaQtqiC9XHUwMDAwTpmXlD+SqKC6W1DNiLrXkzpFXHUwMDE4lLyqcXblOo99JZ7UlKtl7dI35HqovXHulZggrlxmr+pDzmWkzcwv8lx1MDAxYrWkzFxy0GL00ShcdTAwMDdSneVTXHJfSz1r9LyNRevLeb42NtI3QfmQalx1MDAxZeZOXHUwMDEzr6z1+1x1MDAxYzfO8/Dnz8Gk8puY3Fx1MDAxMiY9+I0zgE25hWpcdTAwMDWOWVx1MDAxYmfU3dDaXHUwMDA0MUhSyn+ot6g/a4uG/dFcdTAwMTlTiSexXGZcZlx1MDAxMddcdTAwMDWdN+xFk59l7U+64dhcdTAwMWXVx1xcy53H3O+jYIa5SMerwmDtmTN2c2hcdTAwMTP6eJQjiNOkvYY8S6Ssf9hng2pb5EJgJKL1zDY/07lD1itYizFcdTAwMTJS7UN9KsqhVHdB56FtXFybKFKreVx1MDAwZVx1MDAwM/lcdTAwMDKYpFx1MDAxYVx1MDAxY3HA2tB2yvGoXHUwMDAxhmWj61x1MDAxMdlcdTAwMGZ+ct3IOVx1MDAwMedMyVHmQMX1XHUwMDE0n8k+PKvyk3g55XOdxLRHZ1xcvXmXT1xiP/HlWWqfJ7k4aDlBNXOqydxNPCvafpS7asYyxUpikOrSms9cdTAwMDFcXLs5Ndd+XHUwMDE04znpkEdnXHUwMDE4xIXOKnxepvc0ns6NtDfYZ6pbp1xct1GbS3tfXHUwMDE1XHUwMDFh5Vx1MDAwNpyjqJ6qXHUwMDE5P1x059TGb8JB1ORcdNJcdTAwMWbS/PaZeVczX3gvRNnYSGfPjPZHyDNcdTAwMDHqMr6LuLT9ObzRfpc3NWFcdTAwMTk1REx1O+festFcbj5LijokzMA/p+VcdTAwMDTFrKBaXHUwMDBlscQ7wvWZS8iXyLE2a4wqz/6st83ZXHUwMDEw/MD7XHS3tWNuO85cYnYkdGak+pPudZrcXGYtprXo/EWYmfB5Mqr4roNqOju88CluuZBGq/hcXE+2uqmSP1RcdTAwMGbRuYA4THX3hDlcdTAwMDf+2aTbfJa9alx1MDAxM7JGYlxyQFx1MDAxZFxyXHJcdTAwMDBcdTAwMGVKPmPPXHUwMDE3eE/2Tys+XHUwMDFikbbYdP6nulx0mGk++U4kXHQ15siH51x1MDAwNX82XHUwMDFh22CdcWVKPIXEXHUwMDA3gzk6+8xcdTAwMWbnd/nT1lfcn+fknFAyJ2Seaf3KoYfgXHUwMDE032Wo7ozj84FT4DXeh6XULY/PmvCNzlx1MDAxZVx1MDAwNXOOtKOGPtpcdTAwMWXlLJPvJJhzi4rvWlx1MDAxYb9Zezj3gPucr53zM+Vv4I70TaHYXHUwMDBivs8hXHUwMDFi6WxdXHUwMDE4zJk52Vx1MDAxZFI8TNLWpi127l1l/Vxc0r3i1n8us0mMmnV+XHUwMDFiQ4+7zKeBer7/nCTDtq1aYcxka56C3WFcdTAwMTNue91Qf6xcdTAwMDItl23bRdzcXHIyT2idcd3cXHUwMDFiXHUwMDBl6C749m1cdTAwMDU/+d531qdzXHUwMDFm71x1MDAwZjS14DzCtlx1MDAxMjZon4FVqmtnnGPo/qjJXHUwMDBmXHUwMDE0XHUwMDFi7GPMemq0tY3gXHUwMDFhhrVV41qEtbWtXHUwMDE3sLdNjpd3ZZ5x9Vxcyfd9ea/GeaQvdYpxwfeDsu6Ob4Vjp8TNks5bwHJJd1x1MDAwMKidgEeqsYEx5Fx1MDAwNVlzTVx1MDAxOZONtuM8R7Wp4PvLXHTp2+Dy3NxpSZ5cdTAwMGWYI1mD6epcbstyXHUwMDFjzk1PMbjPZ57ozFGue7C2xFxi50K6RyiBZYNzQ3VcdTAwMWWvne894TOvR1rFNVxmzoFnbW7Hk290Vyt0d8b3efJepypcdTAwMTQ+gyWUXHUwMDA3XHUwMDE3fFZcdTAwMWZfcrHenFx1MDAwYmvmSnPX5zDn2K9cdTAwMTJnXHUwMDAzrtXGbXzm8kzC95RswzCTOko5Wz5LvONcdTAwMWNcdTAwMDfut2eBJs+39VbZ7CfVKMxcdTAwMWb67lx1MDAwNFx1MDAxODWD0Vx1MDAwMprNOaDjQMPEyIFcdTAwMGXnjP3xs0XfIVx1MDAxZFb3aUe0bS/f1IDu17fWcb19qoI6R775dvI12bY8fyfDmK7EoLnPJ5xcdTAwMGasnbzbL05L4P9Bfq/z4+WrsfB9ffm+tddRu6apmWrn/EXkLz/88i9cdFx1MDAxMVW6In0=❯ upstream | | downstream