Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Timeline creation in the api client #2918

Open
Tijnoz opened this issue Sep 30, 2023 · 0 comments · May be fixed by #2919
Open

Timeline creation in the api client #2918

Tijnoz opened this issue Sep 30, 2023 · 0 comments · May be fixed by #2919

Comments

@Tijnoz
Copy link

Tijnoz commented Sep 30, 2023

Our infrastructure uses plaso (psort.py) to load data into OpenSearch. At the moment, we've been using the generate_timeline_from_es_index function to load the data into timesketch. We'd rather use the opensearch_ts module so we don't need another pass over the data. However, for this, we need to have a timeline id to pass along. In general, it would be nice to create searchindexes and timelines via the api client.

Having looked through the code, my suggestion would be to split out the code that creates the timeline and searchindex in the generate_timeline_from_es_index function so these functions can also be called directly. That way, a timeline can be created via the api and passed along to psort.py to send data directly to the right timeline.

I've created a PR that fits my suggestion, but it's the first time working on this codebase so I am happy to amend anything, or throw it all away if a different approach is better! Happy to contribute either way.

@Tijnoz Tijnoz changed the title Timeline create command Timeline creation in the api client Sep 30, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant