Error when importing jsonl file in timesketch

[n3x77]

Hi,

the current json output that is generated for timesketch cannot be imported.
The problem is that the Spyre output file starts with

[
{<JSON-DATA>}
,
...
]

Timesketch cannot handle this. You need to remove "[","]" and "," from the file. Also timesketch expects that the file has the file extension: .jsonl.

It would be great if this could be adjusted in Spyre.

Thx
Sven

[hillu]

Timesketch seems to have changed its behavior here. The issue has been fixed by introducing the tsjsonlines log format.