-
Notifications
You must be signed in to change notification settings - Fork 576
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Timeline creation in the api client #2918
Comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Our infrastructure uses plaso (psort.py) to load data into OpenSearch. At the moment, we've been using the
generate_timeline_from_es_index
function to load the data into timesketch. We'd rather use theopensearch_ts
module so we don't need another pass over the data. However, for this, we need to have a timeline id to pass along. In general, it would be nice to create searchindexes and timelines via the api client.Having looked through the code, my suggestion would be to split out the code that creates the timeline and searchindex in the
generate_timeline_from_es_index
function so these functions can also be called directly. That way, a timeline can be created via the api and passed along to psort.py to send data directly to the right timeline.I've created a PR that fits my suggestion, but it's the first time working on this codebase so I am happy to amend anything, or throw it all away if a different approach is better! Happy to contribute either way.
The text was updated successfully, but these errors were encountered: