{"action":"created","issue":{"url":"https://api.github.com/repos/log2timeline/plaso/issues/103","repository_url":"https://api.github.com/repos/log2timeline/plaso","labels_url":"https://api.github.com/repos/log2timeline/plaso/issues/103/labels{/name}","comments_url":"https://api.github.com/repos/log2timeline/plaso/issues/103/comments","events_url":"https://api.github.com/repos/log2timeline/plaso/issues/103/events","html_url":"https://github.com/log2timeline/plaso/issues/103","id":56130024,"number":103,"title":"Collection Filters Enhancement ","user":{"login":"dnides","id":1940071,"avatar_url":"https://avatars.githubusercontent.com/u/1940071?v=3","gravatar_id":"","url":"https://api.github.com/users/dnides","html_url":"https://github.com/dnides","followers_url":"https://api.github.com/users/dnides/followers","following_url":"https://api.github.com/users/dnides/following{/other_user}","gists_url":"https://api.github.com/users/dnides/gists{/gist_id}","starred_url":"https://api.github.com/users/dnides/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dnides/subscriptions","organizations_url":"https://api.github.com/users/dnides/orgs","repos_url":"https://api.github.com/users/dnides/repos","events_url":"https://api.github.com/users/dnides/events{/privacy}","received_events_url":"https://api.github.com/users/dnides/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/log2timeline/plaso/labels/core","name":"core","color":"fbca04"},{"url":"https://api.github.com/repos/log2timeline/plaso/labels/enhancement","name":"enhancement","color":"84b6eb"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/log2timeline/plaso/milestones/5","html_url":"https://github.com/log2timeline/plaso/milestones/1.5.0%20release","labels_url":"https://api.github.com/repos/log2timeline/plaso/milestones/5/labels","id":1322183,"number":5,"title":"1.5.0 release","description":"","creator":{"login":"joachimmetz","id":3888750,"avatar_url":"https://avatars.githubusercontent.com/u/3888750?v=3","gravatar_id":"","url":"https://api.github.com/users/joachimmetz","html_url":"https://github.com/joachimmetz","followers_url":"https://api.github.com/users/joachimmetz/followers","following_url":"https://api.github.com/users/joachimmetz/following{/other_user}","gists_url":"https://api.github.com/users/joachimmetz/gists{/gist_id}","starred_url":"https://api.github.com/users/joachimmetz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joachimmetz/subscriptions","organizations_url":"https://api.github.com/users/joachimmetz/orgs","repos_url":"https://api.github.com/users/joachimmetz/repos","events_url":"https://api.github.com/users/joachimmetz/events{/privacy}","received_events_url":"https://api.github.com/users/joachimmetz/received_events","type":"User","site_admin":false},"open_issues":42,"closed_issues":7,"state":"open","created_at":"2015-09-24T13:49:48Z","updated_at":"2016-03-13T14:48:07Z","due_on":"2016-06-29T22:00:00Z","closed_at":null},"comments":2,"created_at":"2015-01-31T16:26:00Z","updated_at":"2016-03-17T14:09:01Z","closed_at":null,"body":"Related to my inquiry:\r\n\r\nDo you have any examples of plaso filters for specific files in the recycle bin? We've tried something like: /$Recycle.Bin/.+/$I30 with no success.Also have tried something like /\\$Recycle.Bin/.+/.+ etc to try to get everything x dirs down (this same type of pattern works in other cases)...also did not work.\r\n\r\nRequesting support for the following two items in the collection filters:\r\n\r\n* [ ]  blacklisting entries in the filter files\r\n* [ ] adding recursive support\r\n* [ ] having the ability to define \"negative\" filter files, eg. a separate filter file of files to exclude\r\n* [ ] Add a \"startswith\" and \"endswith\" into the filter criteria\r\n\r\nMy understanding is the current support is limited, since it does not have recursive behavior.... "},"comment":{"url":"https://api.github.com/repos/log2timeline/plaso/issues/comments/197893754","html_url":"https://github.com/log2timeline/plaso/issues/103#issuecomment-197893754","issue_url":"https://api.github.com/repos/log2timeline/plaso/issues/103","id":197893754,"user":{"login":"joachimmetz","id":3888750,"avatar_url":"https://avatars.githubusercontent.com/u/3888750?v=3","gravatar_id":"","url":"https://api.github.com/users/joachimmetz","html_url":"https://github.com/joachimmetz","followers_url":"https://api.github.com/users/joachimmetz/followers","following_url":"https://api.github.com/users/joachimmetz/following{/other_user}","gists_url":"https://api.github.com/users/joachimmetz/gists{/gist_id}","starred_url":"https://api.github.com/users/joachimmetz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joachimmetz/subscriptions","organizations_url":"https://api.github.com/users/joachimmetz/orgs","repos_url":"https://api.github.com/users/joachimmetz/repos","events_url":"https://api.github.com/users/joachimmetz/events{/privacy}","received_events_url":"https://api.github.com/users/joachimmetz/received_events","type":"User","site_admin":false},"created_at":"2016-03-17T14:09:01Z","updated_at":"2016-03-17T14:09:01Z","body":"The realization of this enhance will depend on: https://github.com/log2timeline/plaso/issues/646"}}