Excluding attributes from log files

[etiennevandebijl]

Is there a way to exclude (optional) attributes from the log files when using zeek -r file.pcap ?
Suppose I want to get rid of the SSH host_key attribute, how can I achieve this without changing the SSH.main file but with scripts?

[jsiwek]

A logging filter should be able to help with that:

event zeek_init()
	{
	Log::remove_default_filter(SSH::LOG);
	Log::add_filter(SSH::LOG, [$name="my-filter", $exclude=set("host_key")]);
	}

More info about filters at these places in case it helps you find anything interesting:

• https://docs.zeek.org/en/master/scripts/base/frameworks/logging/main.zeek.html#type-Log::Filter
• https://docs.zeek.org/en/master/frameworks/logging.html#filters