PySpark Plaso  Release 2019
A tool for distributed extraction of timestamps from various files using extractors adapted from the Plaso engine to Apache Spark.
Public Member Functions | Public Attributes | List of all members
plaso.tarzan.mediator.mediator.Mediator Class Reference
Inheritance diagram for plaso.tarzan.mediator.mediator.Mediator:
Inheritance graph
[legend]
Collaboration diagram for plaso.tarzan.mediator.mediator.Mediator:
Collaboration graph
[legend]

Public Member Functions

def __init__ (self)
 
def ProduceEventWithEventData (self, event, event_data)
 
def ProduceExtractionError (self, message, path_spec)
 
def SetFileEntry (self, file_entry)
 
def GetFileEntry (self)
 
def GetFilename (self)
 
def AppendToParserChain (self, plugin_or_parser)
 
def PopFromParserChain (self)
 
def AddEventAttribute (self, attribute_name, attribute_value)
 
def RemoveEventAttribute (self, attribute_name)
 
def abort (self)
 
def temporary_directory (self)
 

Public Attributes

 file_entry
 
 parser_chain_components
 
 collection_filters_helper
 
 codepage
 

Detailed Description

An abstract base-class for Tarzan mediators.

Constructor & Destructor Documentation

◆ __init__()

def plaso.tarzan.mediator.mediator.Mediator.__init__ (   self)
Initialize the mediator.

Reimplemented in plaso.tarzan.mediator.print_mediator.PrintMediator.

Member Function Documentation

◆ abort()

def plaso.tarzan.mediator.mediator.Mediator.abort (   self)
Check if the parsing should be aborted.
:return: True if parsing should be aborted

◆ AddEventAttribute()

def plaso.tarzan.mediator.mediator.Mediator.AddEventAttribute (   self,
  attribute_name,
  attribute_value 
)
Adds an attribute that will be set on all events produced.
Setting attributes using this method will cause events produced via this
mediator to have an attribute with the provided name set with the
provided value.
:param attribute_name: name of the attribute to add
:param attribute_value: value of the attribute to add
:raises KeyError: if the event attribute is already set

◆ AppendToParserChain()

def plaso.tarzan.mediator.mediator.Mediator.AppendToParserChain (   self,
  plugin_or_parser 
)
Adds a parser or parser plugin to the parser chain.
:param plugin_or_parser: parser or parser plugin

◆ GetFileEntry()

def plaso.tarzan.mediator.mediator.Mediator.GetFileEntry (   self)
Retrieves the active file entry.
:return: file entry

◆ GetFilename()

def plaso.tarzan.mediator.mediator.Mediator.GetFilename (   self)
Retrieves the name of the active file entry.
:return: name of the active file entry or None

◆ PopFromParserChain()

def plaso.tarzan.mediator.mediator.Mediator.PopFromParserChain (   self)
Removes the last added parser or parser plugin from the parser chain.

◆ ProduceEventWithEventData()

def plaso.tarzan.mediator.mediator.Mediator.ProduceEventWithEventData (   self,
  event,
  event_data 
)
Produce a particular event with its data.
:param event: the event
:param event_data: the event's data

Reimplemented in plaso.tarzan.mediator.buffered_mediator.BufferedMediator, and plaso.tarzan.mediator.print_mediator.PrintMediator.

◆ ProduceExtractionError()

def plaso.tarzan.mediator.mediator.Mediator.ProduceExtractionError (   self,
  message,
  path_spec 
)
Produce an extraction error with a particular message and a path.
:param message: the error message
:param path_spec: the erroneous path

Reimplemented in plaso.tarzan.mediator.buffered_mediator.BufferedMediator, and plaso.tarzan.mediator.print_mediator.PrintMediator.

◆ RemoveEventAttribute()

def plaso.tarzan.mediator.mediator.Mediator.RemoveEventAttribute (   self,
  attribute_name 
)
Removes an attribute from being set on all events produced.
:param attribute_name: name of the attribute to remove
:raises KeyError: if the event attribute is not set

◆ SetFileEntry()

def plaso.tarzan.mediator.mediator.Mediator.SetFileEntry (   self,
  file_entry 
)
Sets the active file entry.
:param file_entry: file entry

◆ temporary_directory()

def plaso.tarzan.mediator.mediator.Mediator.temporary_directory (   self)
A path of the directory for temporary files.
:return: path of the directory for temporary files.

Member Data Documentation

◆ codepage

plaso.tarzan.mediator.mediator.Mediator.codepage

◆ collection_filters_helper

plaso.tarzan.mediator.mediator.Mediator.collection_filters_helper

◆ file_entry

plaso.tarzan.mediator.mediator.Mediator.file_entry

◆ parser_chain_components

plaso.tarzan.mediator.mediator.Mediator.parser_chain_components

The documentation for this class was generated from the following file: