(
        file_path, events, timeline_name, index_name, source_type,
        timeline_id)
return index_name
Create a Celery task for processing Plaso storage file.

    Args:
        file_path: Path to the plaso file on disk.
        events: String with event data, invalid for plaso files.
        timeline_name: Name of the Timesketch timeline.
        index_name: Name of the datastore index.
        source_type: Type of file, csv or jsonl.
        timeline_id: ID of the timeline object this data belongs to.

    Raises:
        RuntimeError: If the function is called using events, plaso
            is not installed or is of unsupported version.
    Returns:
        Name (str) of the index.
Create a Celery task for processing Plaso storage file.
Create a Celery task for processing Plaso storage file .
def run_plaso(
        file_path, events, timeline_name, index_name, source_type,
        timeline_id):
    """Create a Celery task for processing Plaso storage file.

    Args:
        file_path: Path to the plaso file on disk.
        events: String with event data, invalid for plaso files.
        timeline_name: Name of the Timesketch timeline.
        index_name: Name of the datastore index.
        source_type: Type of file, csv or jsonl.
        timeline_id: ID of the timeline object this data belongs to.

    Raises:
        RuntimeError: If the function is called using events, plaso
            is not installed or is of unsupported version.
    Returns:
        Name (str) of the index.
    """
    if not plaso:
        raise RuntimeError(
            'Plaso isn\'t installed, unable to continue processing plaso '
            'files.')

    plaso_version = int(plaso.__version__)
    if plaso_version <= PLASO_MINIMUM_VERSION:
        raise RuntimeError(
            'Plaso version is out of date (version {0:d}, please upgrade to a '
            'version that is later than {1:d}'.format(
                plaso_version, PLASO_MINIMUM_VERSION))

    if events:
        raise RuntimeError('Plaso uploads needs a file, not events.')

    event_type = 'generic_event'  # Document type for OpenSearch

    mappings = None
    mappings_file_path = current_app.config.get('PLASO_MAPPING_FILE', '')
    if os.path.isfile(mappings_file_path):
        try:
            with open(mappings_file_path, 'r') as mfh:
                mappings = json.load(mfh)

                if not isinstance(mappings, dict):
                    raise RuntimeError(
                        'Unable to create mappings, the mappings are not a '
                        'dict, please look at the file: {0:s}'.format(
                            mappings_file_path))
        except (json.JSONDecodeError, IOError):
            logger.error('Unable to read in mapping', exc_info=True)

    opensearch_server = current_app.config.get('OPENSEARCH_HOST')
    if not opensearch_server:
        raise RuntimeError(
            'Unable to connect to OpenSearch, no server set, unable to '
            'process plaso file.')
    opensearch_port = current_app.config.get('OPENSEARCH_PORT')
    if not opensearch_port:
        raise RuntimeError(
            'Unable to connect to OpenSearch, no port set, unable to '
            'process plaso file.')

    opensearch = OpenSearchDataStore(
        host=opensearch_server, port=opensearch_port)

    try:
        opensearch.create_index(
            index_name=index_name, doc_type=event_type, mappings=mappings)
    except errors.DataIngestionError as e:
        _set_timeline_status(timeline_id, status='fail', error_msg=str(e))
        _close_index(
            index_name=index_name, data_store=opensearch,
            timeline_id=timeline_id)
        raise

    except (RuntimeError, ImportError, NameError, UnboundLocalError,
            RequestError) as e:
        _set_timeline_status(timeline_id, status='fail', error_msg=str(e))
        _close_index(
            index_name=index_name, data_store=opensearch,
            timeline_id=timeline_id)
        raise

    except Exception as e:  # pylint: disable=broad-except
        # Mark the searchindex and timelines as failed and exit the task
        error_msg = traceback.format_exc()
        _set_timeline_status(timeline_id, status='fail', error_msg=error_msg)
        logger.error('Error: {0!s}\n{1:s}'.format(e, error_msg))
        _close_index(
            index_name=index_name, data_store=opensearch,
            timeline_id=timeline_id)
        return None

    message = 'Index timeline [{0:s}] to index [{1:s}] (source: {2:s})'
    logger.info(message.format(timeline_name, index_name, source_type))

    try:
        psort_path = current_app.config['PSORT_PATH']
    except KeyError:
        psort_path = 'psort.py'

    cmd = [
        psort_path, '-o', 'elastic_ts', file_path,
        '--server', opensearch_server,
        '--port', str(opensearch_port), '--status_view', 'none',
        '--index_name', index_name,
    ]

    if mappings_file_path:
        cmd.extend(['--elastic_mappings', mappings_file_path])

    if timeline_id:
        cmd.extend(['--timeline_identifier', str(timeline_id)])

    opensearch_username = current_app.config.get('OPENSEARCH_USER', '')
    if opensearch_username:
        cmd.extend(['--elastic_user', opensearch_username])

    opensearch_password = current_app.config.get('OPENSEARCH_PASSWORD', '')
    if opensearch_password:
        cmd.extend(['--elastic_password', opensearch_password])

    opensearch_ssl = current_app.config.get('OPENSEARCH_SSL', False)
    if opensearch_ssl:
        cmd.extend(['--use_ssl'])

    psort_memory = current_app.config.get('PLASO_UPPER_MEMORY_LIMIT', '')
    if psort_memory:
        cmd.extend(['--process_memory_limit', str(psort_memory)])

    # Run psort.py
    try:
        subprocess.check_output(
            cmd, stderr=subprocess.STDOUT, encoding='utf-8')
    except subprocess.CalledProcessError as e:
        # Mark the searchindex and timelines as failed and exit the task
        _set_timeline_status(timeline_id, status='fail', error_msg=e.output)
        _close_index(
            index_name=index_name, data_store=opensearch,
            timeline_id=timeline_id)
        return e.output

    # Mark the searchindex and timelines as ready
    _set_timeline_status(timeline_id, status='ready')

    return index_name
def run_plaso ( file_path , events , timeline_name , index_name , source_type , timeline_id ) : if not plaso : raise RuntimeError ( 'Plaso isn\'t installed, unable to continue processing plaso ' 'files.' ) plaso_version = int ( plaso . __version__ ) if plaso_version <= PLASO_MINIMUM_VERSION : raise RuntimeError ( 'Plaso version is out of date (version {0:d}, please upgrade to a ' 'version that is later than {1:d}' . format ( plaso_version , PLASO_MINIMUM_VERSION ) ) if events : raise RuntimeError ( 'Plaso uploads needs a file, not events.' ) event_type = 'generic_event' # Document type for OpenSearch mappings = None mappings_file_path = current_app . config . get ( 'PLASO_MAPPING_FILE' , '' ) if os . path . isfile ( mappings_file_path ) : try : with open ( mappings_file_path , 'r' ) as mfh : mappings = json . load ( mfh ) if not isinstance ( mappings , dict ) : raise RuntimeError ( 'Unable to create mappings, the mappings are not a ' 'dict, please look at the file: {0:s}' . format ( mappings_file_path ) ) except ( json . JSONDecodeError , IOError ) : logger . error ( 'Unable to read in mapping' , exc_info = True ) opensearch_server = current_app . config . get ( 'OPENSEARCH_HOST' ) if not opensearch_server : raise RuntimeError ( 'Unable to connect to OpenSearch, no server set, unable to ' 'process plaso file.' ) opensearch_port = current_app . config . get ( 'OPENSEARCH_PORT' ) if not opensearch_port : raise RuntimeError ( 'Unable to connect to OpenSearch, no port set, unable to ' 'process plaso file.' ) opensearch = OpenSearchDataStore ( host = opensearch_server , port = opensearch_port ) try : opensearch . create_index ( index_name = index_name , doc_type = event_type , mappings = mappings ) except errors . DataIngestionError as e : _set_timeline_status ( timeline_id , status = 'fail' , error_msg = str ( e ) ) _close_index ( index_name = index_name , data_store = opensearch , timeline_id = timeline_id ) raise except ( RuntimeError , ImportError , NameError , UnboundLocalError , RequestError ) as e : _set_timeline_status ( timeline_id , status = 'fail' , error_msg = str ( e ) ) _close_index ( index_name = index_name , data_store = opensearch , timeline_id = timeline_id ) raise except Exception as e : # pylint: disable=broad-except # Mark the searchindex and timelines as failed and exit the task error_msg = traceback . format_exc ( ) _set_timeline_status ( timeline_id , status = 'fail' , error_msg = error_msg ) logger . error ( 'Error: {0!s}\n{1:s}' . format ( e , error_msg ) ) _close_index ( index_name = index_name , data_store = opensearch , timeline_id = timeline_id ) return None message = 'Index timeline [{0:s}] to index [{1:s}] (source: {2:s})' logger . info ( message . format ( timeline_name , index_name , source_type ) ) try : psort_path = current_app . config [ 'PSORT_PATH' ] except KeyError : psort_path = 'psort.py' cmd = [ psort_path , '-o' , 'elastic_ts' , file_path , '--server' , opensearch_server , '--port' , str ( opensearch_port ) , '--status_view' , 'none' , '--index_name' , index_name , ] if mappings_file_path : cmd . extend ( [ '--elastic_mappings' , mappings_file_path ] ) if timeline_id : cmd . extend ( [ '--timeline_identifier' , str ( timeline_id ) ] ) opensearch_username = current_app . config . get ( 'OPENSEARCH_USER' , '' ) if opensearch_username : cmd . extend ( [ '--elastic_user' , opensearch_username ] ) opensearch_password = current_app . config . get ( 'OPENSEARCH_PASSWORD' , '' ) if opensearch_password : cmd . extend ( [ '--elastic_password' , opensearch_password ] ) opensearch_ssl = current_app . config . get ( 'OPENSEARCH_SSL' , False ) if opensearch_ssl : cmd . extend ( [ '--use_ssl' ] ) psort_memory = current_app . config . get ( 'PLASO_UPPER_MEMORY_LIMIT' , '' ) if psort_memory : cmd . extend ( [ '--process_memory_limit' , str ( psort_memory ) ] ) # Run psort.py try : subprocess . check_output ( cmd , stderr = subprocess . STDOUT , encoding = 'utf-8' ) except subprocess . CalledProcessError as e : # Mark the searchindex and timelines as failed and exit the task _set_timeline_status ( timeline_id , status = 'fail' , error_msg = e . output ) _close_index ( index_name = index_name , data_store = opensearch , timeline_id = timeline_id ) return e . output # Mark the searchindex and timelines as ready _set_timeline_status ( timeline_id , status = 'ready' ) return index_name