diff --git a/docs/index.rst b/docs/index.rst index 21cc9fb..cc89c97 100644 --- a/docs/index.rst +++ b/docs/index.rst @@ -3,9 +3,9 @@ You can adapt this file completely to your liking, but it should at least contain the root `toctree` directive. -====================================== -Welcome to parsedmarc's documentation! -====================================== +=========================================================================== +parsedmarc documentation - Open source DMARC report analyzer and visualizer +=========================================================================== |Build Status| @@ -312,6 +312,14 @@ On Debian or Ubuntu systems, run: $ sudo apt-get install libemail-outlook-message-perl + +Testing multiple report analyzers +--------------------------------- + +If you would like to test parsedmarc and another report processing solution +at the same time, you can have up to two mailto URIs each in the rua and ruf +tags tgs in your DMARC record, separated by commas. + Elasticsearch and Kibana ------------------------ diff --git a/parsedmarc/elastic.py b/parsedmarc/elastic.py index a943436..4826069 100644 --- a/parsedmarc/elastic.py +++ b/parsedmarc/elastic.py @@ -298,9 +298,8 @@ def save_forensic_report_to_elasticsearch(forensic_report): search = forensic_index.search() from_query = {"match": {"sample.headers.from": headers["from"]}} subject_query = {"match": {"sample.headers.subject": headers["subject"]}} - arrival_date_query = {"match": {"sample.headers.arrival_date": arrival_date - }} - q = Q(from_query) & Q(subject_query) & Q(arrival_date_query) + arrival_query = {"match": {"sample.headers.arrival_date": arrival_date}} + q = Q(from_query) & Q(subject_query) & Q(arrival_query) if "to" in headers: to_query = {"match": {"sample.headers.to": headers["to"]}} q & Q(to_query)