olaf
olaf copied to clipboard
Update olaf.py
Hello. This script has been really useful so thank you for making it available. I made the following changes to the code:
- added additional variables at the beginning to make it easier to update the index and deal with logs with columns in a different order.
- added code to repair truncated json. We found that the majority of the malformed line errors we got were because the Audit Data column was truncated
- made it so the it skips reading the header only if a header is present
- checks IP columns to make sure they contain an IP before doing geo lookup
- added "source" column to the index to make it easier to track what log events came from