Elasticsearch

[antmar904]

Hi.

Once analysis is done and the analyzer has stopped and all processes are closed is there a way to load the data extracted from memory back into Elasticsearch or do I need to analyze the memory dump again to get back to Elastic?

[evild3ad]

Should work...the indexed JSON data is stored in "./Tools/Elasticsearch/data", but I haven't tested it yet.

You can comment some functions in the Main (bottom of the script) to speed up things or launch Elasticsearch and Kibana manually.

I think I will split all features to more functions in v.04,

[antmar904]

awesome, ill give it a try! I also have my own instance of SOF-ELK running. I'm going to try to import the JSON data from the analysis and into it's own index.

[antmar904]

What data is imported into Elastic, forensic\json ?