# Plaso Custom Command Line

**URL:** <https://community.limacharlie.com/t/plaso-custom-command-line/486>\
**Category:** Support\
**Tags:** extension\
**Created:** [September 29, 2025, 1:53am UTC](https://community.limacharlie.com/t/plaso-custom-command-line/486 "2025-09-29T01:53:08Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![joshlemon](https://yyz1.discourse-cdn.com/flex033/user_avatar/community.limacharlie.com/joshlemon/32/158_2.png) [@joshlemon](https://community.limacharlie.com/u/joshlemon)\
**Post date:** [September 29, 2025, 1:53am UTC](https://community.limacharlie.com/t/plaso-custom-command-line/486/1 "2025-09-29T01:53:08Z")

</div>

Can you modify the Plaso extension to enable users to customise the command line used by Plaso?

Currently, the command [is set to this](https://docs.limacharlie.io/docs/ext-plaso?highlight=plaso#extension-configuration). This is good as a default, but for those who are familiar with Plaso, there is better tuning that can be done, based on the type of investigation being conducted.

I want the ability to tune the command line used for the Plaso execution, as I don’t always want Plaso to run `psteal.py`. Additionally, I’d like to be able to tune the parsers used by Plaso or provide it with a filter file to speed up the time it takes Plaso to execute.

This could be done by providing a text field in the extension that allows for overriding the `psteal.py` command.

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex033/uploads/limacharlie/original/1X/b2e9829e8e4281f2e5d87b4c4d424583144efe20.svg) [@system](https://community.limacharlie.com/u/system)\
**Post date:** [October 6, 2025, 1:53am UTC](https://community.limacharlie.com/t/plaso-custom-command-line/486/2 "2025-10-06T01:53:37Z")

</div>

Closed on October 6, 2025, 1:53am UTC

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.