diff --git a/plaso/output/opensearch_ts.py b/plaso/output/opensearch_ts.py index b04c05e3c1..dc5e53c73b 100644 --- a/plaso/output/opensearch_ts.py +++ b/plaso/output/opensearch_ts.py @@ -34,9 +34,11 @@ def _WriteFieldValues(self, output_mediator, field_values): modules and other components, such as storage and dfVFS. field_values (dict[str, str]): output field values per name. """ - event_document = { - '__ts_timeline_id': self._timeline_identifier, - 'index': {'_index': self._index_name}} + event_document = {'index': {'_index': self._index_name}} + + # Add timeline_id on the event level. It is used in Timesketch to + # support shared indices. + field_values['__ts_timeline_id'] = self._timeline_identifier self._event_documents.append(event_document) self._event_documents.append(field_values)