es4forensics 0.5.1

Import several timelines into elasticsearch
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63

use chrono::{DateTime, Utc, TimeZone, NaiveDateTime, LocalResult};
use chrono_tz::Tz;
use serde::Serialize;
use serde_json::{Value, json};
use std::hash::Hash;
use anyhow::{anyhow, Result};

#[derive(Eq, PartialEq, Clone, Hash, PartialOrd, Ord)]
pub struct Timestamp {
    ts: i64,
}

impl Serialize for Timestamp {
    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
    where
        S: serde::Serializer {
        serializer.serialize_i64(self.ts)
    }
}

impl<Tz> From<DateTime<Tz>> for Timestamp where Tz: TimeZone {
    fn from(d: DateTime<Tz>) -> Self {
        let ts = d.with_timezone(&Utc);
        log::trace!("converting {:?} to {}", d, ts.timestamp_millis());
        Self {
            ts: ts.timestamp_millis(),
        }
    }
}


impl TryFrom<(i64, &Tz)> for Timestamp {
    type Error = anyhow::Error;

    fn try_from((unix_ts, src_tz): (i64, &Tz)) -> Result<Self, Self::Error> {

        let ts = match src_tz.from_local_datetime(&NaiveDateTime::from_timestamp(unix_ts, 0)) {
            LocalResult::None => {
                return Err(anyhow!("INVALID DATETIME"));
            }
            LocalResult::Single(t) => t,
            LocalResult::Ambiguous(t1, _t2) => t1,
        };
        Ok(
            Self {
                ts: ts.timestamp_millis(),
            }
        )
    }
}


impl From<&Timestamp> for Value {
    fn from(ts: &Timestamp) -> Self {
        json!(ts.ts)
    }
}

impl Timestamp {
    pub fn timestamp_millis(&self) -> i64 {
        self.ts
    }
}