---
warning: DO NOT CHANGE THIS MANUALLY, THIS IS GENERATED BY https://github.com/duckdb/community-extensions repository, check README there
title: zeek
excerpt: |
  DuckDB Community Extensions
  Read Zeek network security monitor log files with automatic schema detection and type-aware parsing

extension:
  name: zeek
  description: Read Zeek network security monitor log files with automatic schema detection and type-aware parsing
  version: 0.5.0
  language: C++
  build: cmake
  license: MIT
  maintainers:
    - ynadji

repo:
  github: ynadji/zeek-duckdb
  # ref builds against DuckDB v2.0.0 (latest stable) from main. andium (v1.4.x) and variegata (v1.5.x)
  # keep the last commit that builds against those versions.
  ref: f79f5e27809095018e9a8fba071564d7fb71c459
  andium: ad3580e3ba6130d0da395ad283cfca4e9cbb2024
  variegata: ad3580e3ba6130d0da395ad283cfca4e9cbb2024

docs:
  hello_world: |
    INSTALL zeek FROM community;
    LOAD inet; # if you want to automatically parse IPs and CIDRs.
    LOAD zeek;

    -- Read a Zeek log file (supports .gz compression and globs)
    SELECT * FROM read_zeek('conn.log.gz');

    -- Filter by service
    SELECT ts, id_orig_h, id_resp_h, service
    FROM read_zeek('conn.log.gz')
    WHERE service = 'http';
  extended_description: |
    The zeek extension adds a `read_zeek()` table function for natively reading
    [Zeek](https://zeek.org/) (formerly Bro) network security monitor TSV log files.

    Features include:

    - automatic schema detection from Zeek log headers (`#fields`, `#types`)
    - automatic gzip/zstd decompression
    - glob pattern support for reading multiple files at once
    - proper NULL handling for Zeek's unset (`-`) and empty (`(empty)`) markers
    - type-aware parsing with rich type mappings:
      - `time` to `TIMESTAMP WITH TIME ZONE`
      - `interval` to `INTERVAL`
      - `addr`/`subnet` to `INET` (with `inet=false` option for `VARCHAR`)
      - `port` to `USMALLINT`
      - `vector[T]`/`set[T]` to `LIST[T]`
    - optional `filename` column for tracking source files across globs

extension_star_count: 6
extension_star_count_pretty: 6
extension_download_count: 871
extension_download_count_pretty: 871
image: '/images/community_extensions/social_preview/preview_community_extension_zeek.png'
layout: community_extension_doc
---
### Compatibility Matrix

This table covers all DuckDB releases that have not reached [end-of-life](https://duckdb.org/release_calendar), including LTS releases, and shows the 2 most recent patch releases of each. Older patch releases are not listed, but the extension may be available for them as well.

<div class="extension_compatibility_table"></div>

| Platform | 1.4.4 | 1.4.5 | 1.5.5 | 1.5.6 | 2.0.0 |
| :--- | :---: | :---: | :---: | :---: | :---: |
| Linux AMD64 | ❌ | ❌ | ✅ | ✅ | ✅ |
| Linux ARM64 | ❌ | ❌ | ✅ | ✅ | ✅ |
| macOS AMD64 | ❌ | ❌ | ✅ | ✅ | ❌ |
| macOS ARM64 | ❌ | ❌ | ✅ | ✅ | ✅ |
| Windows AMD64 | ❌ | ❌ | ✅ | ✅ | ✅ |
| Windows ARM64 | ❌ | ❌ | ❌ | ❌ | ❌ |
| WebAssembly | ❌ | ❌ | ✅ | ✅ | ✅ |

### Installing and Loading
```sql
INSTALL {{ page.extension.name }} FROM community;
LOAD {{ page.extension.name }};
```

{% if page.docs.hello_world %}
### Example
```sql
{{ page.docs.hello_world }}```
{% endif %}

{% if page.docs.extended_description %}
### About {{ page.extension.name }}
{{ page.docs.extended_description }}
{% endif %}
### Added Functions

<div class="extension_functions_table"></div>

| function_name | function_type | description | comment | examples |
|---------------|---------------|-------------|---------|----------|
| read_zeek     | table         | NULL        | NULL    |          |

### Overloaded Functions

<div class="extension_functions_table"></div>

This extension does not add any function overloads.

### Added Types

<div class="extension_types_table"></div>

This extension does not add any types.

### Added Settings

<div class="extension_settings_table"></div>

|      name      |                       description                       | input_type | scope  | aliases | typed_value |
|----------------|---------------------------------------------------------|------------|--------|---------|-------------|
| temp_directory | Set the directory to which temporary files are written. | VARCHAR    | GLOBAL | []      | post.db.tmp |