diff --git a/l2tscaffolder/templates/sqlite_plugin.jinja2 b/l2tscaffolder/templates/sqlite_plugin.jinja2 index 669cd80..4cc7cef 100644 --- a/l2tscaffolder/templates/sqlite_plugin.jinja2 +++ b/l2tscaffolder/templates/sqlite_plugin.jinja2 @@ -10,7 +10,7 @@ from __future__ import unicode_literals from dfdatetime import posix_time as dfdatetime_posix_time from plaso.containers import time_events -from plaso.lib import eventdata +from plaso.containers import events from plaso.parsers import sqlite from plaso.parsers.sqlite_plugins import interface {% for query_name, query in queries.items()|sort(false) %} diff --git a/l2tscaffolder/templates/sqlite_plugin_formatter.jinja2 b/l2tscaffolder/templates/sqlite_plugin_formatter.jinja2 index 47659f0..810c31a 100644 --- a/l2tscaffolder/templates/sqlite_plugin_formatter.jinja2 +++ b/l2tscaffolder/templates/sqlite_plugin_formatter.jinja2 @@ -6,7 +6,7 @@ from plaso.formatters import manager from plaso.lib import errors{% for query_name in queries %} -class {{ class_name }}{{ query_name|capitalize }}Formatter(interface.ConditionalEventFormatter): +class {{ class_name }}{{ query_name|capitalize }}FormatterHelper(interface.CustomEventFormatterHelper): """{{ plugin_name|replace('_',' ')}} {{ query_name|lower }} event formatter.""" DATA_TYPE = '{{ data_types[query_name] }}' @@ -26,7 +26,7 @@ class {{ class_name }}{{ query_name|capitalize }}Formatter(interface.Conditional {% endfor %} -manager.FormattersManager.RegisterFormatter([ +manager.FormattersManager.RegisterEventFormatterHelpers([ {% for query_name in queries %}{{ class_name }}{{ query_name|capitalize }}Formatter{% if not loop.last %}, {% endif %}{% endfor %} ])