Linux Parsers do not read Logs with Number at End + CSV Seperator Request about zircolite HOT 5 CLOSED

Hello,

Could you please add handling of .log.number files to this thanks.

I will code something cleaner but you should already be able to do that by using --fileext and providing 'log*'

For .csv files could you please add a command line argument to specify the delimiter.

I have added an --csv-delimiter, I will push code soon

I got confused when reading it just for your reference in case people try like me to use the csv template instead of --csv

Done (I think)

from zircolite.

Everything should be ok in #65. Docs have been updated (I think :))

from zircolite.

Could you please add handling of .log.number files to this thanks.

ok !

For .csv files could you please add a command line argument to specify the delimiter.

ok !

I got confused when reading it just for your reference in case people try like me to use the csv template instead of --csv

You are right I will remove any CSV reference. The template was not a good idea.

from zircolite.

Thanks I appreciate it!

Could you please add handling of .log.number files to this thanks.

I will code something cleaner but you should already be able to do that by using --fileext and providing 'log*' instead

I didn't even realise fileext could support wildcards. You learn something new every day. Probably would be better to handle it by default though since it is a very common occurrence on Linux and people may be confused by it only processing .log

from zircolite.

The current version with delimiter support is in the csv-delimiter branch : https://github.com/wagga40/Zircolite/tree/csv-delimiter

Usage :

python3 zircolite.py -e ./logs/ -r rules.json --fileext 'evtx*' --csv --csv-delimiter "|"

I think I will merge this week end.

from zircolite.