# Adding File Extension to the Extract File

**URL:** <https://community.zeek.org/t/adding-file-extension-to-the-extract-file/7103>\
**Category:** Zeek\
**Created:** [August 2, 2023, 8:19am UTC](https://community.zeek.org/t/adding-file-extension-to-the-extract-file/7103 "2023-08-02T08:19:41Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![SFD](https://avatars.discourse-cdn.com/v4/letter/s/5f9b8f/32.png) [@SFD](https://community.zeek.org/u/SFD)\
**Post date:** [August 2, 2023, 8:19am UTC](https://community.zeek.org/t/adding-file-extension-to-the-extract-file/7103/1 "2023-08-02T08:19:41Z")

</div>

Hello all,

I am using **5.0.7-0 Zeek-Lts**. I obtained the _ID_ and _mime\_type_ from the log files and saved them in json format as “.log”. In another .zeek file where the files are extracted, I edited the name format of the extracted files. I want to add the file extension to the output file (e.g. extracted\_file.pdf). When I use function on\_add(f:fa\_file, Files::AnalyzerArgs) or file\_sniff I don’t get the correct extension. How could I solve that problem and get the right mime\_type?

Thanks for now,  
Best

---

<div class="post-metadata">

**Author:** ![SFD](https://avatars.discourse-cdn.com/v4/letter/s/5f9b8f/32.png) [@SFD](https://community.zeek.org/u/SFD)\
**Post date:** [August 4, 2023, 5:54am UTC](https://community.zeek.org/t/adding-file-extension-to-the-extract-file/7103/2 "2023-08-04T05:54:08Z")

</div>

When I got the `meta$mime_type` and parsed it then added to the end of the extracted file name, wrong extension was appeared. For instance, in the log file (comparing with the ID of the file to check same file) the mime type was jpeg and the extract file was also image but in the name of the file had html **-extract\_ID\_html-** should be **extract\_ID\_jpeg**. So I need the exact mime type of the file. Also I tried to take log file using global value. But it did not correspond right type. It seems to be same as the extracted file name.

As for why I’m doing this, -e.g.- when the pdf file is extracted, it gives an error when I want to open it. The extensions should be written at the end of the files as “.pdf” so that I do not change the name of each file repeatedly.

How could I fix that?

---

<div class="post-metadata">

**Author:** ![awelzel](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/awelzel/32/609_2.png) [@awelzel](https://community.zeek.org/u/awelzel)\
**Post date:** [August 4, 2023, 1:09pm UTC](https://community.zeek.org/t/adding-file-extension-to-the-extract-file/7103/3 "2023-08-04T13:09:04Z")

</div>

Hello @SFD - I’m afraid you need to provide example snippets or output and what you’re instead expecting.

May have suggested that before, but have you looked into the `hosom/file-extraction` package - or installed it via zkg and see if that provides the wanted behavior? It contains a table mapping some known mime-types to file extensions and I wonder if this i how thes what you need?

> <https://github.com/hosom/file-extraction/blob/master/scripts/main.zeek#L14>

> <https://github.com/hosom/file-extraction/blob/master/scripts/file-extensions.zeek>

---

<div class="post-metadata">

**Author:** ![SFD](https://avatars.discourse-cdn.com/v4/letter/s/5f9b8f/32.png) [@SFD](https://community.zeek.org/u/SFD)\
**Post date:** [August 8, 2023, 10:57am UTC](https://community.zeek.org/t/adding-file-extension-to-the-extract-file/7103/4 "2023-08-08T10:57:00Z")

</div>

Thanks for reply, the table mapping some known mime-types to file extensions worked for me. 🙂