Changed Timesketch output to add timeline_id per event (#4576)

log2timeline · Mar 8, 2023 · 7c2b1b0 · 7c2b1b0
1 parent c6d4ff8
commit 7c2b1b0
Showing 1 changed file with 5 additions and 3 deletions.
diff --git a/plaso/output/opensearch_ts.py b/plaso/output/opensearch_ts.py
@@ -34,9 +34,11 @@ def _WriteFieldValues(self, output_mediator, field_values):
           modules and other components, such as storage and dfVFS.
       field_values (dict[str, str]): output field values per name.
     """
-    event_document = {
-        '__ts_timeline_id': self._timeline_identifier,
-        'index': {'_index': self._index_name}}
+    event_document = {'index': {'_index': self._index_name}}
+
+    # Add timeline_id on the event level. It is used in Timesketch to
+    # support shared indices.
+    field_values['__ts_timeline_id'] = self._timeline_identifier
 
     self._event_documents.append(event_document)
     self._event_documents.append(field_values)