Zeek – JSON Log Output

There are cases where it is preferred to send your logs in JSON format.
Why?
Because JSON format is easier to parse.
So if you want to send your logs to a SIEM like the ELK or  IBM QRadar you have to make
the following changes at the Zeek Configuration.

Add to /opt/zeek/share/zeek/site/local.zeek

 @load policy/tuning/json-logs.zeek