From 48ca180db50ade20f876214b6f303336de5a45d3 Mon Sep 17 00:00:00 2001
From: Sean Whalen <whalenster@gmail.com>
Date: Sun, 14 Oct 2018 05:16:52 -0400
Subject: [PATCH] Fix header checks

---
 parsedmarc/elastic.py | 12 ++++++------
 parsedmarc/utils.py   |  4 ++--
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/parsedmarc/elastic.py b/parsedmarc/elastic.py
index 3ea65ed..dac79ea 100644
--- a/parsedmarc/elastic.py
+++ b/parsedmarc/elastic.py
@@ -326,16 +326,16 @@ def save_forensic_report_to_elasticsearch(forensic_report,
     from_ = None
     to_ = None
     subject = None
-    if "from" in headers:
-        from_ = headers["from"]
+    if "From" in headers:
+        from_ = headers["From"]
         from_query = {"match": {"sample.headers.from": from_}}
         q = q & from_query
-    if "to" in headers:
-        to_ = headers["to"]
+    if "To" in headers:
+        to_ = headers["To"]
         to_query = {"match": {"sample.headers.to": to_}}
         q = q & Q(to_query)
-    if "subject" in headers:
-        subject = headers["subject"]
+    if "Subject" in headers:
+        subject = headers["Subject"]
         subject_query = {"match": {"sample.headers.subject": subject}}
         q = q & subject_query
 
diff --git a/parsedmarc/utils.py b/parsedmarc/utils.py
index 16c9847..653f625 100644
--- a/parsedmarc/utils.py
+++ b/parsedmarc/utils.py
@@ -405,8 +405,8 @@ def parse_email(data):
                                                                     " ")
 
     if "from" not in parsed_email:
-        if "from" in parsed_email["headers"]:
-            parsed_email["from"] = parsed_email["Headers"]["from"]
+        if "From" in parsed_email["headers"]:
+            parsed_email["from"] = parsed_email["Headers"]["From"]
         else:
             parsed_email["from"] = None