# Bro -r using multiple PCAP **URL:** \ **Category:** Zeek\ **Created:** [April 29, 2019, 8:57pm UTC](https://community.zeek.org/t/bro-r-using-multiple-pcap/5684 "2019-04-29T20:57:58Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![David\_Decker](https://avatars.discourse-cdn.com/v4/letter/d/a88e4f/32.png) [@David\_Decker](https://community.zeek.org/u/David_Decker)\ **Post date:** [April 29, 2019, 8:57pm UTC](https://community.zeek.org/t/bro-r-using-multiple-pcap/5684/1 "2019-04-29T20:57:58Z")
Looking to see if anyone has created a script, or if this is an argument to process multiple PCAPS using the bro -r argument. I have it setup to output to JSON currently and change from EPOCH time to normal date/time output, but that is one at a time, and will have multiple. Looking at either a batch script of maybe python but wanted to see if anyone has done this bfore. (Reingest multiple old PCAP files) to get re-ingested. Dave ---
**Author:** ![JustinAzoff](https://avatars.discourse-cdn.com/v4/letter/j/13edae/32.png) [@JustinAzoff](https://community.zeek.org/u/JustinAzoff)\ **Post date:** [April 29, 2019, 10:15pm UTC](https://community.zeek.org/t/bro-r-using-multiple-pcap/5684/2 "2019-04-29T22:15:05Z")
You can specify -r multiple times. Something like import subprocess import glob cmd = ["bro"] for f in glob.glob("\*.pcap"):     cmd.extend(["-r", f]) subprocess.call(cmd) will work to a point. Eventually you will hit ARG\_MAX with enough files. but for a few dozen this works fine. For more, something like [https://github.com/assafmo/joincap](https://github.com/assafmo/joincap) could be better. I outlined a good way to do this as an input plugin a while back as well: [http://mailman.icsi.berkeley.edu/pipermail/zeek/2017-July/012355.html](http://mailman.icsi.berkeley.edu/pipermail/zeek/2017-July/012355.html) ---
**Author:** ![Patrick\_Kelley1](https://avatars.discourse-cdn.com/v4/letter/p/aeb1de/32.png) [@Patrick\_Kelley1](https://community.zeek.org/u/Patrick_Kelley1)\ **Post date:** [May 1, 2019, 2:31am UTC](https://community.zeek.org/t/bro-r-using-multiple-pcap/5684/3 "2019-05-01T02:31:57Z")
I run the following in a local folder for several ingest types (PREDICT, malware-traffic-analysis, etc…). Logstash, etc… does the rest. Hope it helps. Additionally, I have a watcher process written in Python to watch for pcaps that are dropped into a directory. ![image001.png](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/edcd7fecc87c1a3c4c493627cdf4951cb57911f7.png) ---
**Author:** ![David\_Decker](https://avatars.discourse-cdn.com/v4/letter/d/a88e4f/32.png) [@David\_Decker](https://community.zeek.org/u/David_Decker)\ **Post date:** [May 1, 2019, 4:30am UTC](https://community.zeek.org/t/bro-r-using-multiple-pcap/5684/4 "2019-05-01T04:30:21Z")
Update on the Bro -r using multiple scripts. I guess I should add that I am needing to break out the logs (either by PCAP or by say day) not sure what is the easiest. Thanks everyone so far. Still working out the kinks i guess. New to this. ---
**Author:** ![ottO](https://avatars.discourse-cdn.com/v4/letter/o/bbe5ce/32.png) [@ottO](https://community.zeek.org/u/ottO)\ **Post date:** [May 2, 2019, 1:34pm UTC](https://community.zeek.org/t/bro-r-using-multiple-pcap/5684/5 "2019-05-02T13:34:34Z")
I made a quick github project with the script I had sent David. [https://github.com/ottobackwards/run-bro-pcap-directory](https://github.com/ottobackwards/run-bro-pcap-directory) if anyone is interested. ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:46pm UTC](https://community.zeek.org/t/bro-r-using-multiple-pcap/5684/6 "2022-05-06T15:46:28Z")