diff --git a/parsedmarc/elastic.py b/parsedmarc/elastic.py index 63718928..b21f20b4 100644 --- a/parsedmarc/elastic.py +++ b/parsedmarc/elastic.py @@ -307,8 +307,10 @@ def save_forensic_report_to_elasticsearch(forensic_report, """ logger.debug("Saving forensic report to Elasticsearch") forensic_report = forensic_report.copy() - sample_date = forensic_report["parsed_sample"]["date"] - sample_date = human_timestamp_to_datetime(sample_date) + sample_date = None + if forensic_report["parsed_sample"]["date"] is not None: + sample_date = forensic_report["parsed_sample"]["date"] + sample_date = human_timestamp_to_datetime(sample_date) original_headers = forensic_report["parsed_sample"]["headers"] headers = OrderedDict() for original_header in original_headers: diff --git a/parsedmarc/utils.py b/parsedmarc/utils.py index 724d7d61..4a747962 100644 --- a/parsedmarc/utils.py +++ b/parsedmarc/utils.py @@ -399,6 +399,10 @@ def parse_email(data): " ") parsed_email["from"] = parse_email_address(parsed_email["from"][0]) + if "date" in parsed_email: + parsed_email["date"] = parsed_email["date"].replace("T", " ") + else: + parsed_email["date"] = None if "reply_to" in parsed_email: parsed_email["reply_to"] = list(map(lambda x: parse_email_address(x), parsed_email["reply_to"]))