# Zeek file extract, redef FileExtract::prefix

**URL:** <https://community.zeek.org/t/zeek-file-extract-redef-fileextract-prefix/7785>\
**Category:** Zeek\
**Created:** [May 20, 2025, 7:36am UTC](https://community.zeek.org/t/zeek-file-extract-redef-fileextract-prefix/7785 "2025-05-20T07:36:22Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![w2k8](https://avatars.discourse-cdn.com/v4/letter/w/2acd7d/32.png) [@w2k8](https://community.zeek.org/u/w2k8)\
**Post date:** [May 20, 2025, 7:36am UTC](https://community.zeek.org/t/zeek-file-extract-redef-fileextract-prefix/7785/1 "2025-05-20T07:36:22Z")

</div>

Hi,

I have a question:

I want to extract files from the network stream.  
In the local.zeek i have added a line:  
redef FileExtract::prefix"/data/extract\_files/";  
@load customscript

I have added a CustomFileExtraction script which extract certain file types.  
Zeek extract the given filetypes, but zeek keep using the folder /usr/local/zeek/spool/extract\_files/[worker\_id]

when i use the command zeekctl config, the fileextractdir points to /usr/local/zeek/spool/extract\_files

Zeek is working fine, and the files-types are extracted like it should. I cant change the folder where the extracted files are stored. I would like to have 1 folder without the workers dir.

I use zeek version 7.1.0 in a docker container.

---

<div class="post-metadata">

**Author:** ![awelzel](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/awelzel/32/609_2.png) [@awelzel](https://community.zeek.org/u/awelzel)\
**Post date:** [May 25, 2025, 12:57pm UTC](https://community.zeek.org/t/zeek-file-extract-redef-fileextract-prefix/7785/2 "2025-05-25T12:57:01Z")

</div>

> when i use the command zeekctl config, the fileextractdir points to /usr/local/zeek/spool/extract\_files

Yeah, it’s just a base, zeekctl always append the `Cluster::node` value so there’s no chance of writing into another node’s files.

> [@w2k8](#):
>
> Zeek is working fine, and the files-types are extracted like it should. I cant change the folder where the extracted files are stored. I would like to have 1 folder without the workers dir.

I’d suggest you look at writing a custom `file_state_remove()` handler. This handler runs after the file was extracted and one can add logic to move the file to a central directory or maybe day/time based directory structure, taking care of not accidentally overwriting existing files. If the directories are on the same filesystem, the move should be instant.

Do you want to give it a try, otherwise I’d be up for sketching a handler, too.

---

<div class="post-metadata">

**Author:** ![w2k8](https://avatars.discourse-cdn.com/v4/letter/w/2acd7d/32.png) [@w2k8](https://community.zeek.org/u/w2k8)\
**Post date:** [May 28, 2025, 12:37pm UTC](https://community.zeek.org/t/zeek-file-extract-redef-fileextract-prefix/7785/3 "2025-05-28T12:37:23Z")

</div>

Thanks,

We are going to look into it.