(self, my_dict)
Adjusts a dict with so that it can be uploaded to Timesketch.

        This function will take a dictionary and modify it. Summary of the
        changes are:
          * If "message" is not a key and a format message string has been
              defined, a message field is constructed.
          * If "datetime" is not a key, an attempt to generate it is made.
          * If "timestamp_desc" is not set but defined by the importer it
              is added.
          * All keys that start with an underscore ("_") are removed.

        Args:
            my_dict: a dictionary that may be missing few fields needed
                    for Timesketch.
Adjusts a dict with so that it can be uploaded to Timesketch.
Adjusts a dict with so that it can be uploaded to Timesketch .
def _fix_dict(self, my_dict):
        """Adjusts a dict with so that it can be uploaded to Timesketch.

        This function will take a dictionary and modify it. Summary of the
        changes are:
          * If "message" is not a key and a format message string has been
              defined, a message field is constructed.
          * If "datetime" is not a key, an attempt to generate it is made.
          * If "timestamp_desc" is not set but defined by the importer it
              is added.
          * All keys that start with an underscore ("_") are removed.

        Args:
            my_dict: a dictionary that may be missing few fields needed
                    for Timesketch.
        """
        if 'message' not in my_dict:
            format_string = (
                self._format_string or utils.get_combined_message_string(
                    mydict=my_dict))
            my_dict['message'] = format_string.format(**my_dict)

        _ = my_dict.setdefault('timestamp_desc', self._timestamp_desc)
        if self._data_type:
            _ = my_dict.setdefault('data_type', self._data_type)

        if 'datetime' not in my_dict:
            date = ''
            if self._datetime_field:
                value = my_dict.get(self._datetime_field)
                if value:
                    date = utils.get_datestring_from_value(value)
            if not date:
                for key in my_dict:
                    key_string = key.lower()
                    if 'time' not in key_string:
                        continue

                    if key_string == 'timestamp_desc':
                        continue

                    value = my_dict[key]
                    date = utils.get_datestring_from_value(value)
                    if date:
                        break

            if date:
                my_dict['datetime'] = date
        else:
            my_dict['datetime'] = utils.get_datestring_from_value(
                my_dict['datetime'])

        # We don't want to include any columns that start with an underscore.
        underscore_columns = [x for x in my_dict if x.startswith('_')]
        if underscore_columns:
            for column in underscore_columns:
                del my_dict[column]
def _fix_dict ( self , my_dict ) : if 'message' not in my_dict : format_string = ( self . _format_string or utils . get_combined_message_string ( mydict = my_dict ) ) my_dict [ 'message' ] = format_string . format ( * * my_dict ) _ = my_dict . setdefault ( 'timestamp_desc' , self . _timestamp_desc ) if self . _data_type : _ = my_dict . setdefault ( 'data_type' , self . _data_type ) if 'datetime' not in my_dict : date = '' if self . _datetime_field : value = my_dict . get ( self . _datetime_field ) if value : date = utils . get_datestring_from_value ( value ) if not date : for key in my_dict : key_string = key . lower ( ) if 'time' not in key_string : continue if key_string == 'timestamp_desc' : continue value = my_dict [ key ] date = utils . get_datestring_from_value ( value ) if date : break if date : my_dict [ 'datetime' ] = date else : my_dict [ 'datetime' ] = utils . get_datestring_from_value ( my_dict [ 'datetime' ] ) # We don't want to include any columns that start with an underscore. underscore_columns = [ x for x in my_dict if x . startswith ( '_' ) ] if underscore_columns : for column in underscore_columns : del my_dict [ column ]