search

teamdfir / sift

SIFT
MIT License
489 stars 67 forks source link

Log2Timeline elsatic search too recent!! #436

Closed MickMJ closed 4 years ago

MickMJ commented 4 years ago

I downloaded the latest version of SIFT-Workstation which is built on Ubuntu 16.04. Installation to a VM was fine.

However, when I tried to run the log2timeline command - log2timeline.py plaso.dump diskimage.e01

I get an error that tells me: [FAILURE] elasticsearch version 6.2.0 is to recent, 5,5,1 or earlier required

I am working with an .E01 image taken from a laptop that was running Windows 10 Any ideas would be helpful.

ekristen commented 4 years ago

Try downgrading elasticsearch

MickMJ commented 4 years ago

I have tried - sudo apt-get remove elasticsearch - and to ensure it was gone, I ran it again.

Installed 5.5.1 using - sudo apt-get install elasticsearch=5.5.1

Still receiving the same "elasticsearch version is too recent" error. Removed elastic search and tried to run Log2Timeline without elastic search installed -- and I still get the same error message.

stale[bot] commented 4 years ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.