{"action":"created","issue":{"url":"https://api.github.com/repos/google/timesketch/issues/206","repository_url":"https://api.github.com/repos/google/timesketch","labels_url":"https://api.github.com/repos/google/timesketch/issues/206/labels{/name}","comments_url":"https://api.github.com/repos/google/timesketch/issues/206/comments","events_url":"https://api.github.com/repos/google/timesketch/issues/206/events","html_url":"https://github.com/google/timesketch/issues/206","id":174354619,"number":206,"title":"Error when using psort.py to load timeline into timesketch","user":{"login":"incident-responder-x","id":21369828,"avatar_url":"https://avatars.githubusercontent.com/u/21369828?v=3","gravatar_id":"","url":"https://api.github.com/users/incident-responder-x","html_url":"https://github.com/incident-responder-x","followers_url":"https://api.github.com/users/incident-responder-x/followers","following_url":"https://api.github.com/users/incident-responder-x/following{/other_user}","gists_url":"https://api.github.com/users/incident-responder-x/gists{/gist_id}","starred_url":"https://api.github.com/users/incident-responder-x/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/incident-responder-x/subscriptions","organizations_url":"https://api.github.com/users/incident-responder-x/orgs","repos_url":"https://api.github.com/users/incident-responder-x/repos","events_url":"https://api.github.com/users/incident-responder-x/events{/privacy}","received_events_url":"https://api.github.com/users/incident-responder-x/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2016-08-31T19:13:42Z","updated_at":"2016-09-01T14:47:10Z","closed_at":null,"body":"I can see that the timesketch output module is enabled in psort but I see the attached error when attempting to load the timeline into timesketch using psort.\r\n\r\nI followed the installation instructions wiki, installed postgresql and elasticsearch, and can connect to timesketch and login ok. How do I resolve this error please. Thanks for your help!\r\n[error.txt](https://github.com/google/timesketch/files/448083/error.txt)\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/google/timesketch/issues/comments/244102367","html_url":"https://github.com/google/timesketch/issues/206#issuecomment-244102367","issue_url":"https://api.github.com/repos/google/timesketch/issues/206","id":244102367,"user":{"login":"berggren","id":316362,"avatar_url":"https://avatars.githubusercontent.com/u/316362?v=3","gravatar_id":"","url":"https://api.github.com/users/berggren","html_url":"https://github.com/berggren","followers_url":"https://api.github.com/users/berggren/followers","following_url":"https://api.github.com/users/berggren/following{/other_user}","gists_url":"https://api.github.com/users/berggren/gists{/gist_id}","starred_url":"https://api.github.com/users/berggren/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/berggren/subscriptions","organizations_url":"https://api.github.com/users/berggren/orgs","repos_url":"https://api.github.com/users/berggren/repos","events_url":"https://api.github.com/users/berggren/events{/privacy}","received_events_url":"https://api.github.com/users/berggren/received_events","type":"User","site_admin":false},"created_at":"2016-09-01T14:47:10Z","updated_at":"2016-09-01T14:47:10Z","body":"Plaso have had some pretty large changes lately, in particular the storage format has changed and psort does not have backwords compatibility with older plaso files created with v1.4.\r\n\r\nIn order to be compatible with elasticsearch > 1.x we there was a fix in the timesketch output module that dropped the mapping for _timestamp.\r\n\r\nWhat this means is that you need to use Plaso version 1.54RC2 (or HEAD) for now to pick up the changes. Sorry for the inconvinience, I will update the wiki with this information.\r\n"}}
{"actor":{"display_login":"berggren"}}