(self, data_frame)
return data_frame[columns]
Returns a data frame with added columns for Timesketch upload.

        Args:
            data_frame: a pandas data frame.

        Returns:
            A pandas data frame with added columns needed for Timesketch.
Returns a data frame with added columns for Timesketch upload.
Returns a data frame with added columns for Timesketch upload .
def _fix_data_frame(self, data_frame):
        """Returns a data frame with added columns for Timesketch upload.

        Args:
            data_frame: a pandas data frame.

        Returns:
            A pandas data frame with added columns needed for Timesketch.
        """
        if 'message' not in data_frame:
            format_string = (
                self._format_string or utils.get_combined_message_string(
                    dataframe=data_frame))
            utils.format_data_frame(data_frame, format_string)

        if 'timestamp_desc' not in data_frame:
            data_frame['timestamp_desc'] = self._timestamp_desc

        if self._data_type and 'data_type' not in data_frame:
            data_frame['data_type'] = self._data_type

        if 'datetime' not in data_frame:
            if self._datetime_field and self._datetime_field in data_frame:
                try:
                    data_frame['timestamp'] = pandas.to_datetime(
                        data_frame[self._datetime_field], utc=True)
                except ValueError as e:
                    logger.info(
                        'Unable to convert timestamp in column: %s, error %s',
                        self._datetime_field, e)
            else:
                for column in data_frame.columns[
                        data_frame.columns.str.contains('time', case=False)]:
                    if column.lower() == 'timestamp_desc':
                        continue
                    try:
                        data_frame['timestamp'] = pandas.to_datetime(
                            data_frame[column], utc=True)
                        # We want the first successful timestamp value.
                        break
                    except ValueError as e:
                        logger.info(
                            'Unable to convert timestamp in column: '
                            '%s, error %s', column, e)

            if 'timestamp' in data_frame:
                data_frame['datetime'] = data_frame['timestamp'].dt.strftime(
                    '%Y-%m-%dT%H:%M:%S%z')
                data_frame['timestamp'] = data_frame[
                    'timestamp'].astype(numpy.int64) / 1e9
        else:
            try:
                date = pandas.to_datetime(data_frame['datetime'], utc=True)
                data_frame['datetime'] = date.dt.strftime('%Y-%m-%dT%H:%M:%S%z')
            except Exception:  # pylint: disable=broad-except
                logger.error(
                    'Unable to change datetime, is it badly formed?',
                    exc_info=True)

        # TODO: Support labels in uploads/imports.
        if 'label' in data_frame:
            del data_frame['label']
            logger.warning(
                'Labels cannot be imported at this time. Therefore the '
                'label column was dropped from the dataset.')

        # We don't want to include any columns that start with an underscore.
        columns = list(
            data_frame.columns[~data_frame.columns.str.contains('^_')])
        return data_frame[columns]
def _fix_data_frame ( self , data_frame ) : if 'message' not in data_frame : format_string = ( self . _format_string or utils . get_combined_message_string ( dataframe = data_frame ) ) utils . format_data_frame ( data_frame , format_string ) if 'timestamp_desc' not in data_frame : data_frame [ 'timestamp_desc' ] = self . _timestamp_desc if self . _data_type and 'data_type' not in data_frame : data_frame [ 'data_type' ] = self . _data_type if 'datetime' not in data_frame : if self . _datetime_field and self . _datetime_field in data_frame : try : data_frame [ 'timestamp' ] = pandas . to_datetime ( data_frame [ self . _datetime_field ] , utc = True ) except ValueError as e : logger . info ( 'Unable to convert timestamp in column: %s, error %s' , self . _datetime_field , e ) else : for column in data_frame . columns [ data_frame . columns . str . contains ( 'time' , case = False ) ] : if column . lower ( ) == 'timestamp_desc' : continue try : data_frame [ 'timestamp' ] = pandas . to_datetime ( data_frame [ column ] , utc = True ) # We want the first successful timestamp value. break except ValueError as e : logger . info ( 'Unable to convert timestamp in column: ' '%s, error %s' , column , e ) if 'timestamp' in data_frame : data_frame [ 'datetime' ] = data_frame [ 'timestamp' ] . dt . strftime ( '%Y-%m-%dT%H:%M:%S%z' ) data_frame [ 'timestamp' ] = data_frame [ 'timestamp' ] . astype ( numpy . int64 ) / 1e9 else : try : date = pandas . to_datetime ( data_frame [ 'datetime' ] , utc = True ) data_frame [ 'datetime' ] = date . dt . strftime ( '%Y-%m-%dT%H:%M:%S%z' ) except Exception : # pylint: disable=broad-except logger . error ( 'Unable to change datetime, is it badly formed?' , exc_info = True ) # TODO: Support labels in uploads/imports. if 'label' in data_frame : del data_frame [ 'label' ] logger . warning ( 'Labels cannot be imported at this time. Therefore the ' 'label column was dropped from the dataset.' ) # We don't want to include any columns that start with an underscore. columns = list ( data_frame . columns [ ~ data_frame . columns . str . contains ( '^_' ) ] ) return data_frame [ columns ]