Issue adding timeline about timesketch HOT 3 CLOSED

Hi, thanks for your report. This indeed looks like a ES issue. I have not run 1.4 myself but will test as soon as possible. Stay tuned.

from timesketch.

Hi, after looking closer at this there seems to be a couple of issues, both of them due to newer versions of elasticsearch.

1. We need to add the _timestamp mapping every time we update.
2. We now need to add the timesketch specific mapping before we populate the index with data.

Since the last big update, all interaction with the system from the command line is via the "tsctl" command installed by timesketch. add_timeline.py is therefor depricated.

I'm working on a new output plugin for plaso psort as a temporary fix for all this. After thet I will start creating a proper Plaso frontend for timesketch and add the ability to add timelines from the UI.

I will open issues for each of these steps.

Closing this issue in the meantime.

from timesketch.

See issue #50 for progress of fixing this.

from timesketch.