# Obtain a MD5 hash from a file in disk **URL:** \ **Category:** Zeek\ **Created:** [May 11, 2016, 9:03am UTC](https://community.zeek.org/t/obtain-a-md5-hash-from-a-file-in-disk/4150 "2016-05-11T09:03:41Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Luis\_Martin](https://avatars.discourse-cdn.com/v4/letter/l/4af34b/32.png) [@Luis\_Martin](https://community.zeek.org/u/Luis_Martin)\ **Post date:** [May 11, 2016, 9:03am UTC](https://community.zeek.org/t/obtain-a-md5-hash-from-a-file-in-disk/4150/1 "2016-05-11T09:03:41Z")
Hi there, I need some help to obtain a MD5 hash of file. But not a file obtained from an HTTP stream. I have my own network payload I have written to disk:                  f=open(payload\_filename);                  if (write\_file(f, payload))                  {                          close(f);                  } in this case the file handler "f" is of type "file". I tried adding it to an MD5 analyzer:                          #Files::add\_analyzer(f, Files::ANALYZER\_MD5); However this request needs a "fa\_file" record, associated with a stream not a "file" handler... Anyone can explain how can I obtain a MD5 hash from a file in disk? Thank you! ---
**Author:** ![Chris\_Welber\_yahoo](https://avatars.discourse-cdn.com/v4/letter/c/8edcca/32.png) [@Chris\_Welber\_yahoo](https://community.zeek.org/u/Chris_Welber_yahoo)\ **Post date:** [May 11, 2016, 10:27am UTC](https://community.zeek.org/t/obtain-a-md5-hash-from-a-file-in-disk/4150/2 "2016-05-11T10:27:29Z")
Does any one have a method for creating metrics with bro. In regards to IT security needs: I.e. How many malware event types, violations, etc? ---
**Author:** ![Luis\_Martin](https://avatars.discourse-cdn.com/v4/letter/l/4af34b/32.png) [@Luis\_Martin](https://community.zeek.org/u/Luis_Martin)\ **Post date:** [May 11, 2016, 10:58am UTC](https://community.zeek.org/t/obtain-a-md5-hash-from-a-file-in-disk/4150/3 "2016-05-11T10:58:18Z")
Ok, Found it. Only had to use the function md5\_hash …of the payload, not the handler. ---
**Author:** ![Gary\_Faulkner1](https://avatars.discourse-cdn.com/v4/letter/g/aeb1de/32.png) [@Gary\_Faulkner1](https://community.zeek.org/u/Gary_Faulkner1)\ **Post date:** [May 11, 2016, 4:58pm UTC](https://community.zeek.org/t/obtain-a-md5-hash-from-a-file-in-disk/4150/4 "2016-05-11T16:58:07Z")
Have you looked at Bro-statsd? If you are comfortable with Bro scripting and something like graphite or influxdb you should be able to do just about anything. [https://github.com/JustinAzoff/bro-statsd-plugin](https://github.com/JustinAzoff/bro-statsd-plugin) ---
**Author:** ![Bible\_Landy](https://avatars.discourse-cdn.com/v4/letter/b/65b543/32.png) [@Bible\_Landy](https://community.zeek.org/u/Bible_Landy)\ **Post date:** [May 12, 2016, 2:35am UTC](https://community.zeek.org/t/obtain-a-md5-hash-from-a-file-in-disk/4150/5 "2016-05-12T02:35:39Z")
We use Logstash to ship the our Bro logs into ElasticSearch, then we use Kibana to create all sorts of interesting dashboards related to our traffic. If you use the JSON output plugin for Bro it makes it easy because you don’t need to try to write Bro filters for Logstash to parse the logs, just pump the JSON directly into ElasticSearch. Be aware that ElasticSearch 2 doesn’t allow dots in field names, so you’ll either need to stick with the 1x branch or use Logstash filters to remove the dots. ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:43pm UTC](https://community.zeek.org/t/obtain-a-md5-hash-from-a-file-in-disk/4150/6 "2022-05-06T15:43:40Z")