bro-cut (1) - Linux Manuals

bro-cut: parse Bro logs


bro-cut - parse Bro logs


bro-cut [options] [columns]


Extracts the given columns from ASCII Bro logs on standard input, and outputs them to standard output. If no columns are given, all are selected. By default, bro-cut does not include format header blocks in the output.

Columns are specified as a list of space-separated field names. The order of field names given to bro-cut determines the output order, which means bro-cut can be used to reorder columns.

The ASCII Bro logs read on standard input must have intact format header blocks because bro-cut needs this information to correctly interpret the log file format. In fact, bro-cut can process the concatenation of multiple ASCII log files that have different column layouts.


Include the first format header block into the output.
Include all format header blocks into the output.
Convert time values into human-readable format.
-D <fmt> Like -d, but specify format for time (see strftime(3) for syntax).
-F <ofs> Sets a different output field separator.
Print all fields except those specified.
Like -d, but print timestamps in UTC instead of local time.
-U <fmt> Like -D, but print timestamps in UTC instead of local time.


For time conversion option -d or -u, the format string can be specified by setting this environment variable.


Output three columns and convert time values:
cat conn.log | bro-cut -d ts id.orig_h id.orig_p

Output all columns and convert time values with a custom format string:
cat conn.log | bro-cut -D "%Y-%m-%d %H:%M:%S"


bro-cut was written by The Bro Project <info [at]>.