You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: pipeline/parsers/regular-expression.md
+12-22Lines changed: 12 additions & 22 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,39 +1,30 @@
1
-
# Regular Expression
1
+
# Regular expression
2
2
3
-
The **Regex** parser lets you define a custom Ruby regular expression that uses
4
-
a named capture feature to define which content belongs to which key name.
3
+
The _Regular expression_ parser lets you define a custom Ruby regular expression that uses named capture to define which content belongs to which key name.
5
4
6
-
Use [Tail Multiline](../inputs/tail.md#multiline) when you need to support regexes
7
-
across multiple lines from a `tail`. The [Tail](../inputs/tail.md) input plugin
8
-
treats each line as a separate entity.
5
+
Use [Tail multiline](../inputs/tail.md#multiline) when you need to support regular expressions across multiple lines from a `tail`. The Tail input plugin treats each line as a separate entity.
9
6
10
7
{% hint style="warning" %}
11
8
12
-
Security Warning: Onigmo is a backtracking regex engine. When using expensive
13
-
regex patterns Onigmo can take a long time to perform pattern matching. Read
14
-
["ReDoS"](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS) on OWASP for additional information.
9
+
This parser uses Onigmo, which is a backtracking regular expressions engine. When using complex regular expression patterns, Onigmo can take a long time to perform pattern matching. This can cause a [regular expression denial of service (ReDoS)](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS).
15
10
16
11
{% end hint %}
17
12
18
-
Setting the format to **regex** requires a `regex` configuration key.
13
+
Setting the format to regular expressions requires a `regex` configuration key.
19
14
20
-
## Configuration Parameters
15
+
## Configuration parameters
21
16
22
-
The regex parser supports the following configuration parameters:
17
+
The `regex` parser supports the following configuration parameters:
23
18
24
19
| Key | Description | Default Value |
25
20
| --- | ----------- | ------------- |
26
21
|`Skip_Empty_Values`| If enabled, the parser ignores empty value of the record. |`True`|
27
22
28
-
Fluent Bit uses the [Onigmo](https://github.com/k-takata/Onigmo) regular expression
29
-
library on Ruby mode.
23
+
Fluent Bit uses the [Onigmo](https://github.com/k-takata/Onigmo) regular expression library in Ruby mode.
30
24
31
-
You can use only alphanumeric characters and underscore in group names. For example,
32
-
a group name like `(?<user-name>.*)` causes an error due to the invalid dash (`-`)
33
-
character. Use the [Rubular](http://rubular.com/) web editor to test your expressions.
25
+
You can use only alphanumeric characters and underscore in group names. For example, a group name like `(?<user-name>.*)` causes an error due to the invalid dash (`-`) character. Use the [Rubular](http://rubular.com/) web editor to test your expressions.
34
26
35
-
The following parser configuration example provides rules that can be applied to an
36
-
Apache HTTP Server log entry:
27
+
The following parser configuration example provides rules that can be applied to an Apache HTTP Server log entry:
37
28
38
29
{% tabs %}
39
30
{% tab title="parsers.yaml" %}
@@ -70,8 +61,7 @@ As an example, review the following Apache HTTP Server log entry:
This log entry doesn't provide a defined structure for Fluent Bit. Enabling the
74
-
proper parser can help to make a structured representation of the entry:
64
+
This log entry doesn't provide a defined structure for Fluent Bit. Enabling the proper parser can help to make a structured representation of the entry:
75
65
76
66
```text
77
67
[1154104030, {"host"=>"192.168.2.20",
@@ -84,4 +74,4 @@ proper parser can help to make a structured representation of the entry:
0 commit comments