PySpark Plaso
Release 2019
A tool for distributed extraction of timestamps from various files using extractors adapted from the Plaso engine to Apache Spark.
|
Public Member Functions | |
def | __init__ (self, buffer_queue=None) |
def | ProduceEventWithEventData (self, event, event_data) |
def | ProduceExtractionError (self, message, path_spec=None) |
def | get_buffer_queue (self) |
def | flush_buffer (self, exception_on_error=False) |
![]() | |
def | __init__ (self) |
def | SetFileEntry (self, file_entry) |
def | GetFileEntry (self) |
def | GetFilename (self) |
def | AppendToParserChain (self, plugin_or_parser) |
def | PopFromParserChain (self) |
def | AddEventAttribute (self, attribute_name, attribute_value) |
def | RemoveEventAttribute (self, attribute_name) |
def | abort (self) |
def | temporary_directory (self) |
Public Attributes | |
buffer_queue | |
Event | |
Error | |
![]() | |
file_entry | |
parser_chain_components | |
collection_filters_helper | |
codepage | |
Tarzan mediator putting events into a buffer.
def plaso.tarzan.mediator.buffered_mediator.BufferedMediator.__init__ | ( | self, | |
buffer_queue = None |
|||
) |
Initialize the mediator including its queue if not given.
def plaso.tarzan.mediator.buffered_mediator.BufferedMediator.flush_buffer | ( | self, | |
exception_on_error = False |
|||
) |
Flush the buffer into a list of events and return the list. :param exception_on_error: True to raise an exception of an error event. :return: the list
def plaso.tarzan.mediator.buffered_mediator.BufferedMediator.get_buffer_queue | ( | self | ) |
Get the queue of buffered events. :return: the queue
def plaso.tarzan.mediator.buffered_mediator.BufferedMediator.ProduceEventWithEventData | ( | self, | |
event, | |||
event_data | |||
) |
Produce a particular event with its data. :param event: the event :param event_data: the event's data
Reimplemented from plaso.tarzan.mediator.mediator.Mediator.
def plaso.tarzan.mediator.buffered_mediator.BufferedMediator.ProduceExtractionError | ( | self, | |
message, | |||
path_spec = None |
|||
) |
Produce an extraction error with a particular message and a path. :param message: the error message :param path_spec: the erroneous path
Reimplemented from plaso.tarzan.mediator.mediator.Mediator.
plaso.tarzan.mediator.buffered_mediator.BufferedMediator.buffer_queue |
plaso.tarzan.mediator.buffered_mediator.BufferedMediator.Error |
plaso.tarzan.mediator.buffered_mediator.BufferedMediator.Event |