convert timestamps to human readable format

netflowindexer/bro/searcher.py

@@ -3,6 +3,7 @@
 from netflowindexer.base.searcher import BaseSearcher
 from netflowindexer import util
 import re
+import datetime
 
 class BroSearcher(BaseSearcher):
     def docid_to_date(self, fn):
@@ -13,14 +14,19 @@ def docid_to_date(self, fn):
         t = "%s.%s" % (d, h)
         return util.strptime(t,'%Y-%m-%d.%H')
 
+    def fix_ts(self, line):
+        ts, rest = line.split("\t", 1)
+        ts = datetime.datetime.fromtimestamp(float(ts)).isoformat()
+        return '\t'.join((ts, rest))
+
     def show(self, doc, ips):
         ips = [ip.replace(".", "\.") for ip in ips]
         inner = "|".join(ips)
         rex = re.compile("\t(%s)\t" % inner)
 
         for line in subprocess.Popen(["zcat", doc], stdout=subprocess.PIPE).stdout:
             if rex.search(line):
-                yield line.rstrip()
+                yield self.fix_ts(line.rstrip())
 
     def search(self, ips, dump=False, filter=None, mode=None):
         docs = self.search_ips(ips)

setup.py

@@ -1,6 +1,6 @@
 from setuptools import setup, find_packages
 
-version = '0.1.37'
+version = '0.1.38'
 long_description = ""
 
 setup(name='netflowindexer',