diff --git a/docs/Zircolite_manual.pdf b/docs/Zircolite_manual.pdf index b802306..73dea90 100644 Binary files a/docs/Zircolite_manual.pdf and b/docs/Zircolite_manual.pdf differ diff --git a/zircolite.py b/zircolite.py index 3b8c12f..7d7163f 100755 --- a/zircolite.py +++ b/zircolite.py @@ -595,8 +595,8 @@ def flatten(x, name=""): # Handle timestamp filters if ( self.timeAfter != "1970-01-01T00:00:00" - and self.timeBefore != "9999-12-12T23:59:59" - ) and self.timeField in JSONLine: + or self.timeBefore != "9999-12-12T23:59:59" + ) and (self.timeField in JSONLine): timestamp = time.strptime( JSONLine[self.timeField].split(".")[0].replace("Z", ""), "%Y-%m-%dT%H:%M:%S", @@ -1631,6 +1631,7 @@ def avoidFiles(pathList, avoidFilesList): timeBefore=eventsBefore, limit=args.limit, csvMode=args.csv, + timeField=args.timefield, ) # If we are not working directly with the db diff --git a/zircolite_dev.py b/zircolite_dev.py index 9c717cb..f7fc597 100755 --- a/zircolite_dev.py +++ b/zircolite_dev.py @@ -416,7 +416,7 @@ def flatten(x, name=''): except Exception as e: self.logger.debug(f'JSON ERROR : {e}') # Handle timestamp filters - if (self.timeAfter != "1970-01-01T00:00:00" and self.timeBefore != "9999-12-12T23:59:59") and self.timeField in JSONLine: + if (self.timeAfter != "1970-01-01T00:00:00" or self.timeBefore != "9999-12-12T23:59:59") and (self.timeField in JSONLine): timestamp = time.strptime(JSONLine[self.timeField].split(".")[0].replace("Z",""), '%Y-%m-%dT%H:%M:%S') if timestamp > self.timeAfter and timestamp < self.timeBefore: JSONOutput.append(JSONLine) @@ -1067,8 +1067,8 @@ def avoidFiles(pathList, avoidFilesList): start_time = time.time() # Initialize zirCore - zircoliteCore = zirCore(args.config, logger=consoleLogger, noOutput=args.nolog, timeAfter=eventsAfter, timeBefore=eventsBefore, limit=args.limit, csvMode=args.csv) - + zircoliteCore = zirCore(args.config, logger=consoleLogger, noOutput=args.nolog, timeAfter=eventsAfter, timeBefore=eventsBefore, limit=args.limit, csvMode=args.csv, timeField=args.timefield) + # If we are not working directly with the db if not args.dbonly: # If we are working with json we change the file extension if it is not user-provided