tree-sitter-zeek

May 4, 2026 ยท View on GitHub

A Zeek grammar for tree-sitter.

Background

This grammar parses scripts written in the Zeek scripting language.

The goal of this grammar is to facilitate tooling around Zeek scripts. For that reason, its structure resembles Zeek's grammar but differs in a number of ways. For example, it tracks newlines explicitly and relies more strongly on precedence and associativity to resolve ambiguities. Like Zeek's parser, this one currently doesn't name symbols deeply: for example, the grammar features an expr rule that covers any kind of expression, but the choices aren't currently broken down into, say, addition_expr, or_expr, and similars.

Usage

To use the generated parser directly (e.g. via any of tree-sitter's language bindings), clone this repository. Generated sources are tracked in the src directory. You do not need the tree-sitter CLI to use those sources in your tooling, but you'll likely want it anyway to explore the parser. For example, tree-sitter parse <script> produces the script's syntax tree, and tree-sitter highlight <script> shows syntax-highlighted sources.

Building the parser

  • Install tree-sitter on your machine.
  • Generate the parser: run tree-sitter generate.

Testing

You can find the tests in test. This contains a separater corpus directory for tests with tree-sitter test. You can update the baselines with tree-sitter test -u.

There is also a script called parse-zeek-tree.sh which runs the parser on every Zeek script in the Zeek distribution, reporting any errors.

Releasing a new version

To release a new version manually update the version number in the following ecosystem-specific files:

  • package.json: key version
    • package-lock.json: update package.json and run npm install to update the lock file.
  • pyproject.toml: key project.version
  • Cargo.toml: key package.version
  • tree-sitter.json: key metadata.version
  • CMakeLists.txt: VERSION in project call

Once all versions are consistently updated create a version tag vX.Y.Z and push it. We trigger automatic publishing of releases for all tags.