olaf icon indicating copy to clipboard operation
olaf copied to clipboard

Update olaf.py

Open cherrydrpepper18 opened this issue 7 years ago • 0 comments

Hello. This script has been really useful so thank you for making it available. I made the following changes to the code:

  • added additional variables at the beginning to make it easier to update the index and deal with logs with columns in a different order.
  • added code to repair truncated json. We found that the majority of the malformed line errors we got were because the Audit Data column was truncated
  • made it so the it skips reading the header only if a header is present
  • checks IP columns to make sure they contain an IP before doing geo lookup
  • added "source" column to the index to make it easier to track what log events came from

cherrydrpepper18 avatar Oct 12 '18 22:10 cherrydrpepper18