# BRO 2.4.1. extracted file handling

**URL:** <https://community.zeek.org/t/bro-2-4-1-extracted-file-handling/4062>\
**Category:** Zeek\
**Created:** [March 21, 2016, 3:01pm UTC](https://community.zeek.org/t/bro-2-4-1-extracted-file-handling/4062 "2016-03-21T15:01:50Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![john\_smith](https://avatars.discourse-cdn.com/v4/letter/j/d78d45/32.png) [@john\_smith](https://community.zeek.org/u/john_smith)\
**Post date:** [March 21, 2016, 3:01pm UTC](https://community.zeek.org/t/bro-2-4-1-extracted-file-handling/4062/1 "2016-03-21T15:01:50Z")

</div>

I’ve two questions about file extraction handling with BRO 2.4.1.

1. Right now, all the extracted files are in ASCII format. Is there any easy way to save them in JSON?

2. Would it be possible to add an extracted file itself to file.log? If not, is there any way to copy the extracted file to a new log stream?

Thank you very much in advance.

John

---

<div class="post-metadata">

**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\
**Post date:** [March 25, 2016, 5:02pm UTC](https://community.zeek.org/t/bro-2-4-1-extracted-file-handling/4062/2 "2016-03-25T17:02:20Z")

</div>

Hello,

> 1. Right now, all the extracted files are in ASCII format. Is there any  
> easy way to save them in JSON?

The files are extracted in the way that they are encountered on the wire.  
Bro does not do any processing on them. So - if they are ASCII, they are  
written as ASCII.

> 2. Would it be possible to add an extracted file itself to file.log? If  
> not, is there any way to copy the extracted file to a new log stream?

File extractions happens outside of the normal logging framework; there  
currently is no easy way to copy extracted files to other log streams.

I hope this helps,  
Johanna

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:43pm UTC](https://community.zeek.org/t/bro-2-4-1-extracted-file-handling/4062/3 "2022-05-06T15:43:30Z")

</div>