search

JustinAzoff / flow-indexer

Flow-Indexer indexes flows found in chunked log files from bro,nfdump,syslog, or pcap files
44 stars 6 forks source link

Search boundaries #16

Open jadominguez opened 3 years ago

jadominguez commented 3 years ago

Is there a way to limit the search or dump to a specific date/time range. This can be useful when working on specific incidents where we understand the timeline of the event. I did not see anything specific in the examples that would allow me to do that.

I tried to follow the source code by I am not a Go programmer.

Thank you,

José.

JustinAzoff commented 3 years ago

yeah.. I think that should be doable. The databases index ip address to filename, and the filename_to_time_regex option lets it turn a filename back into a time. I think I could add 'earliest' and 'latest' options to the search and dump endpoints.. would that work?

jadominguez commented 3 years ago

Hello Justin. I think that should do the trick. Could I use both options at the same time? If so, that effectively accomplishes what I was thinking. If only one of the options is used, then we could assume that it should start at the beginning or end of the database set. Thank you.