# Custom development scripts for the HTTP protocol

**URL:** https://community.zeek.org/t/custom-development-scripts-for-the-http-protocol/6977
**Category:** Development
**Created:** [April 10, 2023, 7:42pm UTC](https://community.zeek.org/t/custom-development-scripts-for-the-http-protocol/6977 "2023-04-10T19:42:17Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![LEFEEEEN](https://avatars.discourse-cdn.com/v4/letter/l/9fc348/32.png) [@LEFEEEEN](https://community.zeek.org/u/LEFEEEEN)
#### Post date: [April 10, 2023, 7:42pm UTC](https://community.zeek.org/t/custom-development-scripts-for-the-http-protocol/6977/1 "2023-04-10T19:42:17Z")

</div>

I customized and developed a script called my.zeek to supplement the parsed fields of the HTTP protocol and write them to kafka. When I used zeek - r xx.pcap my.zeek, I saw that the supplemented fields in kafka had values. However, when I added @ load site/http/main (the main. zeek content is my. zeek) at the end of zeek/share/zeek/site/local. zeek, and ran zeekctl deploy, I saw that there were fields in kafka that I wanted to supplement, but the value was ko. Why? Is there a problem with this custom development method? Looking forward to someone helping me answer, thank you!!!

---

<div class="post-metadata">

### Author: ![Christian](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/christian/32/593_2.png) [@Christian](https://community.zeek.org/u/Christian)
#### Post date: [April 13, 2023, 2:05am UTC](https://community.zeek.org/t/custom-development-scripts-for-the-http-protocol/6977/2 "2023-04-13T02:05:40Z")

</div>

Hi there and welcome!

It sounds like you’re quite close since it works in your local testing. Are you sure the clusterized Zeek setup sees suitable traffic? I assume by “ko” you mean those fields are in the logs (confirming that your `site/http/main.zeek` did get deployed and loaded), but are defined `&optional` and have remained unset.

You could also verify via `zeekctl scripts` that your script indeed gets loaded when and where you expect it, and check the other Zeek logs for clues.

Best,  
Christian
