timesketch
timesketch copied to clipboard
Not showing fields starting with '_' (underscore)
Describe the bug If the upload is made with the timeline GUI buttom --> I can show _{fields} in the Explore view If the upload is made with the python API timesketch_import_client --> I can't show them
Example code:
ImportStreamer() as streamer:
streamer.set_sketch(sketch)
streamer.set_timeline_name(timeline_name)
streamer.add_file(path)
Expected behavior I didn't expect to see this fields with any method because I think elasticsearch use _{fields} for internal working processes.
Idk if this is a bug or a feature. Anyway, I comment...
These are scrubbed out by the importer client, but the web UI doesn't do that. The web UI imports need a serious overhaul
Deletion reference in the importer client: https://github.com/google/timesketch/blob/master/importer_client/python/timesketch_import_client/importer.py#L134
@marcobrotto do you want to add that to the CSV and JSON importer to remove columns that start with a _
e.g. _ts_star
?