How to restart a timeline indexing task?

[jloehel]

I have imported several timelines with the help of the cli tool. Some got uploaded and successfully indexed. Some just got uploaded but not fully indexed. There are no pending celery tasks. The timeline is in the status processing. But nothing is actually processed. How can I restart the indexing task for a pending/processing timeline manually? If a restart is not possible, how do I delete such a pending timeline?

I think this quick&dirty hack should work:

import uuid
from timesketch.models.sketch import SearchIndex
from timesketch.models.sketch import Timeline
from timesketch.lib import tasks

# Information about the pending timeline process
# all details are available through `/api/v1/sketches/<sketch id>/timelines/<timeline id>/
search_index_id = <search_index id>
timeline_id = <timeline id>
file_path = "/usr/share/timesketch/upload/<uuid of the timeline>"
events = ""  # Not really necessary for plaso files
timeline_name = "<name of the timeline>"
file_extension = "plaso"  # Can be anything not in {"csv", "jsonl", "json"} if it is a plaso file
sketch_id = <sketch id>
enable_stream = False  # The whole file is already there. No stream
headers_mapping = None
delimiter = ","  # Not really necessary for plaso files

# Just to get sure everthing exits
# Let's get the searchindex first by id
searchindex = SearchIndex.query.get(search_index_id)
# Let's get the timeline by id
timeline = Timeline.query.get(timeline_id)

pipeline = tasks.build_index_pipeline(file_path=file_path, events=events, timeline_name=timeline_name, index_name=searchindex.index_name, file_extension=file_extension, sketch_id=sketch_id, only_index=enable_stream, timeline_id=timeline.id, headers_mapping=headers_mapping, delimiter=delimiter)
task_id = uuid.uuid4().hex
pipeline.apply_async(task_id=task_id)
print(task_id)

After executing apply_async there should be a new task visible via:

docker exec -it timesketch-worker celery -A timesketch.lib.tasks inspect active

This task should have the task_id from above.

Why is it necessary to re-upload the timeline? The timeline is already there and the datasource, too.

edit: It does not work like expected. The task does not consider the events which exist already. I have now dupes there. :-(