Skip to content

Commit 9ae64ff

Browse files
committed
Adding YAML examples to regular expression parser doc. Part of issue #1865.
Signed-off-by: Eric D. Schabell <[email protected]>
1 parent 7ceb131 commit 9ae64ff

File tree

1 file changed

+24
-4
lines changed

1 file changed

+24
-4
lines changed

pipeline/parsers/regular-expression.md

Lines changed: 24 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,10 +8,11 @@ across multiple lines from a `tail`. The [Tail](../inputs/tail.md) input plugin
88
treats each line as a separate entity.
99

1010
{% hint style="warning" %}
11+
1112
Security Warning: Onigmo is a backtracking regex engine. When using expensive
1213
regex patterns Onigmo can take a long time to perform pattern matching. Read
13-
["ReDoS"](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)
14-
on OWASP for additional information.
14+
["ReDoS"](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS) on OWASP for additional information.
15+
1516
{% end hint %}
1617

1718
Setting the format to **regex** requires a `regex` configuration key.
@@ -34,7 +35,23 @@ character. Use the [Rubular](http://rubular.com/) web editor to test your expres
3435
The following parser configuration example provides rules that can be applied to an
3536
Apache HTTP Server log entry:
3637

37-
```python
38+
{% tabs %}
39+
{% tab title="parsers.yaml" %}
40+
41+
```yaml
42+
parsers:
43+
- name: apache
44+
format: regex
45+
regex: '^(?<host>[^ ]*) [^ ]* (?<user>[^ ]*) \[(?<time>[^\]]*)\] "(?<method>\S+)(?: +(?<path>[^\"]*?)(?: +\S*)?)?" (?<code>[^ ]*) (?<size>[^ ]*)(?: "(?<referer>[^\"]*)" "(?<agent>[^\"]*)")?$'
46+
time_key: time
47+
time_format: '%d/%b/%Y:%H:%M:%S %z'
48+
types: pid:integer size:integer
49+
```
50+
51+
{% endtab %}
52+
{% tab title="parsers.conf" %}
53+
54+
```text
3855
[PARSER]
3956
Name apache
4057
Format regex
@@ -44,6 +61,9 @@ Apache HTTP Server log entry:
4461
Types code:integer size:integer
4562
```
4663

64+
{% endtab %}
65+
{% endtabs %}
66+
4767
As an example, review the following Apache HTTP Server log entry:
4868

4969
```text
@@ -64,4 +84,4 @@ proper parser can help to make a structured representation of the entry:
6484
"agent"=>""
6585
}
6686
]
67-
```
87+
```

0 commit comments

Comments
 (0)