Zeek In Action, Video 12,  zeek2es
Channel: Zeek
Date: 2022-01-31

In this video, Keith Jones (Sr. Security Researcher, Corelight) introduces a simple Python program written to help you take your Zeek ASCII tab delimited files and make them full text searchable with ElasticSearch+Kibana (or OpenSearch, if you prefer).  If you don’t have a full text indexer, Keith also shows you a way to query your ASCII text logs using the power of the jq application.  No additional Python libraries are required beyond the default libraries, so using this script on different types of systems is painless.