---
name: "bro-cut"
section: "1"
platform: "linux"
package: "bro-aux"
version: "0.42-1+b1"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/bro-cut"
---

# bro-cut(1)

parse bro logs

## NAME

bro-cut - parse bro logs

## SYNOPSIS

**bro-cut** \[options\] \[\<columns\>\]

## DESCRIPTION

Extracts the given columns from an ASCII Bro log on standard input. If no columns are given, all are selected. By default, **bro-cut** does not include format header blocks into the output.

## OPTIONS

- **-c**

  Include the first format header block into the output.

- **-C**

  Include all format header blocks into the output.

- **-d**

  Convert time values into human-readable format (needs gawk).

**-D** \<fmt\> Like **-d**, but specify format for time (see [strftime(3)](/strftime/3.md) for syntax).

**-F** \<ofs\> Sets a different output field separator.

- **-n**

  Print all fields \*except\* those specified.

- **-u**

  Like **-d**, but print timestamps in UTC instead of local time (needs gawk).

**-U** \<fmt\> Like **-D**, but print timestamps in UTC instead of local time (needs gawk).

## ENVIRONMENT

- **BRO\_CUT\_TIMEFMT**

  For the time conversion, the format string can also be specified by setting an environment variable $**BRO\_CUT\_TIMEFMT**

## EXAMPLES

**cat** conn.log \| **bro-cut** **-d** ts id.orig\_h id.orig\_p

## AUTHOR

**bro-cut** was written by The Bro Project \<info@bro.org\>.

This manual page was written by Raúl Benencia \<rul@kalgan.cc\> for the Debian project (but may be used by others).