ZEEK-CUT(1)

💖 ZEEK-CUT(1) 💖

okay bestie, so this is zeek-cut, part of the User Commands squad. it's giving "tiny tool, huge main character energy." let's get into it 🦋

---

✨ NAME ✨

zeek-cut — parse Zeek logs 💅

---

🌸 SYNOPSIS 🌸

zeek-cut [options] [columns]

---

🎀 DESCRIPTION 🎀

so basically: you pipe some ASCII Zeek logs into standard input, you tell it which columns you want, and it spits those columns right back out to standard output. that's it. that's the vibe. ✨

if you don't name any fields at all? no stress, it selects all of them. and by default, zeek-cut does not include format header blocks in the output. nope, not doing that unless you ask. 🙈

now, how do you ask for columns? you give a list of field names, separated by spaces. and here's the slay part: the order you give them in is the order they come out. so if you're feeling chaotic and want to shuffle things around, zeek-cut is literally your reordering bestie. 👑

🚨 important, no cap: the ASCII Zeek logs you feed in on standard input must have intact format header blocks. like, they need them. zeek-cut uses that info to correctly interpret the log file format. can't do the math without the numbers, you know? 😭

and here's the flex — zeek-cut can also handle the concatenation of multiple ASCII log files that have different column layouts. yeah. multiple logs, different shapes, one pipe. iconic. 🫶

---

💅 OPTIONS 💅

• -c — include the first format header block in the output. just the one. baby steps. ✨
• -C — include all format header blocks in the output. go big or go home. 🔥
• -m — same as -c (first format header block, hello) but in minimal view. cute and compact. 🎀
• -M — same as -C (all the format header blocks) but in minimal view. maximal content, minimal styling. the duality. 💜
• -d — convert time values into human-readable format. because raw timestamps are not it. 🕰️
• -D <fmt> — like -d, but you get to specify the format for time. peep strftime(3) for the syntax, iykyk. 🧚
• -F <ofs> — sets a different output field separator character. default separator not your thing? change it. 💫
• -h — show help. when in doubt, ask for help. we love a self-aware icon. 🙋‍♀️
• -n — print all fields except the ones you specified. yes, it's the inverse. yes, it's still valid. no, it's not a typo. 😌
• -u — like -d, but print timestamps in UTC instead of local time. timezone girlies rise. 🌍
• -U <fmt> — like -D, but print timestamps in UTC instead of local time. same energy, different clock. ⏰

---

🌈 ENVIRONMENT 🌈

• ZEEK_CUT_TIMEFMT — for the time conversion options -d or -u, you can set the format string by setting this environment variable instead. set it once, vibe forever. ✨

---

🍓 EXAMPLES 🍓

output three columns and convert time values:

cat conn.log | zeek-cut -d ts id.orig_h id.orig_p

output all columns and convert time values with a custom format string:

cat conn.log | zeek-cut -D "%Y-%m-%d %H:%M:%S"

compressed logs must be uncompressed with another utility:

zcat conn.log.gz | zeek-cut

💀 reminder bestie: zeek-cut does not unzip anything for you. zcat (or your decompressor of choice) handles that first, then you hand it over. don't @ me.

---

👀 SEE ALSO 👀

strftime(3) — go read it, it's where the format syntax lives 🫶

---

💖 AUTHOR 💖

zeek-cut was written by The Zeek Project <info@zeek.org>. legends, honestly. 👑

---

and that's the whole page, bestie!! this one's from zeek-cut, dated November 2014, sitting pretty in section 1 of the manual. go forth and parse. periodt. 💅✨🦋