Worked on attribute container identifiers log2timeline#771

joachimmetz · Aug 10, 2016 · e549621 · e549621
1 parent 1b7f616
commit e549621
Showing 1 changed file with 7 additions and 1 deletion.
diff --git a/config/tests/generate_test_files.sh b/config/tests/generate_test_files.sh
@@ -74,9 +74,15 @@ TEST_FILE="psort_test.json.plaso";
 PYTHONPATH=. ./tools/log2timeline.py --buffer_size=300 --quiet ${TEST_FILE} test_data/syslog;
 PYTHONPATH=. ./tools/log2timeline.py --quiet --timezone=Iceland ${TEST_FILE} test_data/syslog;
 
+# cat > tagging.txt <<EOI
+# repeated
+#   body contains 'last message repeated'
+# EOI
+
+# Work-around for issue with object filter support by efilter.
 cat > tagging.txt <<EOI
 repeated
-  body contains 'last message repeated'
+  body == 'last message repeated 5 times'
 EOI
 
 PYTHONPATH=. ./tools/psort.py --analysis tagging --output-format=null --tagging-file=tagging.txt ${TEST_FILE};