Enhancement: Set logging format

[cplmayo]

By default Zeek stores logs in a plain text that if exported to a SIEM or log aggregator require additional parsing and sorting.

Zeek does have the ability to format logs as structured JSON making importing much easier.

Zeek Logging Framework
Zeek to Splunk Example

[shadyabhi]

For anyone who comes here via Google search, if doing to manually, it is as simple as adding the following line:-

# Output to JSON
@load policy/tuning/json-logs.zeek

at location: /usr/local/share/zeek/policy/tuning/defaults/__load__.zeek.

Side note, I tried editing the location /opt/zeek/share/zeek/site/local.zeek directly, but, for whatever reason, JSON logging wasn't getting enabled

Considering how easy it is to enable JSON logging, it should be easy to do via GUI as well.