PySpark Plaso
Release 2019
A tool for distributed extraction of timestamps from various files using extractors adapted from the Plaso engine to Apache Spark.
|
Public Member Functions | |
def | __init__ (self) |
def | ProduceEventWithEventData (self, event, event_data) |
def | ProduceExtractionError (self, message, path_spec) |
def | SetFileEntry (self, file_entry) |
def | GetFileEntry (self) |
def | GetFilename (self) |
def | AppendToParserChain (self, plugin_or_parser) |
def | PopFromParserChain (self) |
def | AddEventAttribute (self, attribute_name, attribute_value) |
def | RemoveEventAttribute (self, attribute_name) |
def | abort (self) |
def | temporary_directory (self) |
Public Attributes | |
file_entry | |
parser_chain_components | |
collection_filters_helper | |
codepage | |
An abstract base-class for Tarzan mediators.
def plaso.tarzan.mediator.mediator.Mediator.__init__ | ( | self | ) |
Initialize the mediator.
Reimplemented in plaso.tarzan.mediator.print_mediator.PrintMediator.
def plaso.tarzan.mediator.mediator.Mediator.abort | ( | self | ) |
Check if the parsing should be aborted. :return: True if parsing should be aborted
def plaso.tarzan.mediator.mediator.Mediator.AddEventAttribute | ( | self, | |
attribute_name, | |||
attribute_value | |||
) |
Adds an attribute that will be set on all events produced. Setting attributes using this method will cause events produced via this mediator to have an attribute with the provided name set with the provided value. :param attribute_name: name of the attribute to add :param attribute_value: value of the attribute to add :raises KeyError: if the event attribute is already set
def plaso.tarzan.mediator.mediator.Mediator.AppendToParserChain | ( | self, | |
plugin_or_parser | |||
) |
Adds a parser or parser plugin to the parser chain. :param plugin_or_parser: parser or parser plugin
def plaso.tarzan.mediator.mediator.Mediator.GetFileEntry | ( | self | ) |
Retrieves the active file entry. :return: file entry
def plaso.tarzan.mediator.mediator.Mediator.GetFilename | ( | self | ) |
Retrieves the name of the active file entry. :return: name of the active file entry or None
def plaso.tarzan.mediator.mediator.Mediator.PopFromParserChain | ( | self | ) |
Removes the last added parser or parser plugin from the parser chain.
def plaso.tarzan.mediator.mediator.Mediator.ProduceEventWithEventData | ( | self, | |
event, | |||
event_data | |||
) |
Produce a particular event with its data. :param event: the event :param event_data: the event's data
Reimplemented in plaso.tarzan.mediator.buffered_mediator.BufferedMediator, and plaso.tarzan.mediator.print_mediator.PrintMediator.
def plaso.tarzan.mediator.mediator.Mediator.ProduceExtractionError | ( | self, | |
message, | |||
path_spec | |||
) |
Produce an extraction error with a particular message and a path. :param message: the error message :param path_spec: the erroneous path
Reimplemented in plaso.tarzan.mediator.buffered_mediator.BufferedMediator, and plaso.tarzan.mediator.print_mediator.PrintMediator.
def plaso.tarzan.mediator.mediator.Mediator.RemoveEventAttribute | ( | self, | |
attribute_name | |||
) |
Removes an attribute from being set on all events produced. :param attribute_name: name of the attribute to remove :raises KeyError: if the event attribute is not set
def plaso.tarzan.mediator.mediator.Mediator.SetFileEntry | ( | self, | |
file_entry | |||
) |
Sets the active file entry. :param file_entry: file entry
def plaso.tarzan.mediator.mediator.Mediator.temporary_directory | ( | self | ) |
A path of the directory for temporary files. :return: path of the directory for temporary files.
plaso.tarzan.mediator.mediator.Mediator.codepage |
plaso.tarzan.mediator.mediator.Mediator.collection_filters_helper |
plaso.tarzan.mediator.mediator.Mediator.file_entry |
plaso.tarzan.mediator.mediator.Mediator.parser_chain_components |