Skip to content

Update olaf.py#3

Open
cherrydrpepper18 wants to merge 1 commit intobromiley:masterfrom
cherrydrpepper18:patch-1
Open

Update olaf.py#3
cherrydrpepper18 wants to merge 1 commit intobromiley:masterfrom
cherrydrpepper18:patch-1

Conversation

@cherrydrpepper18
Copy link

Hello. This script has been really useful so thank you for making it available. I made the following changes to the code:

  • added additional variables at the beginning to make it easier to update the index and deal with logs with columns in a different order.
  • added code to repair truncated json. We found that the majority of the malformed line errors we got were because the Audit Data column was truncated
  • made it so the it skips reading the header only if a header is present
  • checks IP columns to make sure they contain an IP before doing geo lookup
  • added "source" column to the index to make it easier to track what log events came from

Hello. This script has been really useful so thank you for making it available.  I made the following changes to the code:
- added additional variables at the beginning to make it easier to update the index and deal with logs with columns in a different order.
- added code to repair truncated json. We found that the majority of the malformed line errors we got were because the Audit Data column was truncated
- made it so the it skips reading the header only if a header is present
- checks IP columns to make sure they contain an IP before doing geo lookup
- added "source" column to the index to make it easier to track what log events came from
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant