Функции разбора

parse_regex(value: <строка>, pattern: <регулярное выражение>, [numeric_groups: <логическое значение>])
:: <объект>, <ошибка>

parse_regex!("Connection attempt from 192.0.2.0, from 192.0.2.1.",
r'from (?P<ip>\d+\.\d+\.\d+\.\d+)')

{
  "ip": "192.0.2.0"
}

parse_regex!("Connection attempt from 192.0.2.0, from 192.0.2.1.",
r'from (\d+\.\d+\.\d+\.\d+)',
numeric_groups: true)

{
  "0": "from 192.0.2.0",
  "1": "192.0.2.0"
}

parse_regex_all(value: <строка>, pattern: <регулярное выражение>, [numeric_groups: <логическое значение>])
:: <массив> , <ошибка>

parse_regex_all!("Connection attempt from 192.0.2.0, from 192.0.2.1.",
r'from (?P<ip>\d+\.\d+\.\d+\.\d+)',
numeric_groups: true)

[
  {
    "0": "from 192.0.2.0",
    "1": "192.0.2.0",
    "ip": "192.0.2.0"
  },
  {
    "0": "from 192.0.2.1",
    "1": "192.0.2.1",
    "ip": "192.0.2.1"
  }
]

parse_apache_log(value: <строка>, format: <строка>, [timestamp_format: <строка>])
:: <объект>, <ошибка>

parse_apache_log!("192.0.2.0 bob frank [10/Oct/2000:13:55:36 -0700] \"GET /apache_pb.gif HTTP/1.0\" 200 2326",
format: "common")

{
  "host": "192.0.2.0",
  "identity": "bob",
  "message": "GET /apache_pb.gif HTTP/1.0",
  "method": "GET",
  "path": "/apache_pb.gif",
  "protocol": "HTTP/1.0",
  "size": 2326,
  "status": 200,
  "timestamp": "2000-10-10T20:55:36Z",
  "user": "frank"
}

parse_apache_log!(
s'192.0.2.0 bob frank [10/Oct/2000:13:55:36 -0700] "GET /apache_pb.gif HTTP/1.0" 200 2326 "http://www.example.com/vertical/channels/front-end/bandwidth" "Mozilla/5.0 (X11; Linux i686; rv:5.0) Gecko/1945-10-12 Firefox/37.0"',
"combined")

{
  "agent": "Mozilla/5.0 (X11; Linux i686; rv:5.0) Gecko/1945-10-12 Firefox/37.0",
  "host": "192.0.2.0",
  "identity": "bob",
  "message": "GET /apache_pb.gif HTTP/1.0",
  "method": "GET",
  "path": "/apache_pb.gif",
  "protocol": "HTTP/1.0",
  "referrer": "http://www.example.com/vertical/channels/front-end/bandwidth",
  "size": 2326,
  "status": 200,
  "timestamp": "2000-10-10T20:55:36Z",
  "user": "frank"
}

parse_apache_log!(
s'[01/Mar/2021:12:00:19 +0000] [ab:alert] [pid 4803:tid 3814] [client 147.159.108.175:24259] I will bypass the haptic COM bandwidth, that should matrix the CSS driver!',
"error")

{
  "client": "147.159.108.175",
  "message": "I will bypass the haptic COM bandwidth, that should matrix the CSS driver!",
  "module": "ab",
  "pid": 4803,
  "port": 24259,
  "severity": "alert",
  "thread": "3814",
  "timestamp": "2021-03-01T12:00:19Z"
}

rv_parse_avro(value: <строка>, [reader_schema: <строка>])
:: <массив объектов>, <ошибка>

# .message -- путь к сообщению в формате Avro
rv_parse_avro!(.message)

# пример массива объектов
[
  {
    "entity": "001",
    "time": "1433269388"
  },
  {
    "entity": "002",
    "time": "1433270488"
  },
]

# .message -- путь к сообщению в формате Avro
rv_parse_avro!(.message,
reader_schema: s'{"type": "record", "fields": [{"name": "element", "type": "string"}, {"name": "time", "type": "string"}]}')

# пример массива объектов
[
  {
    "element": "001",
    "time": "1433269388"
  },
  {
    "element": "002",
    "time": "1433270488"
  },
]

rv_parse_avro_raw(value: <строка>, decoder_schema: <avro_schema>, [reader_schema: <строка>])
:: <объект>, <ошибка>

# .message -- путь к сообщению в формате Avro
rv_parse_avro_raw!(.message,
decoder_schema: s'{"type": "record", "fields": [{"name": "element", "type": "string"}, {"name": "time", "type": "string"}]}')

# пример объекта
{
  "element": "value",
  "time": "1433270488"
}

# .message -- путь к сообщению в формате Avro
rv_parse_avro_raw!(.message,
decoder_schema: s'{"type": "record", "fields": [{"name": "element", "type": "string"}, {"name": "time", "type": "string"}]}',
reader_schema: s'{"type": "record", "fields": [{"name": "element", "type": "string"}]}')

# пример объекта
{
  "element": "value"
}

parse_aws_alb_log(value: <строка>)
:: <объект>, <ошибка>

parse_aws_alb_log!(
"http 2018-11-30T22:23:00.186641Z app/my-loadbalancer/50dc6c495c0c9188 192.168.131.39:2817 - 0.000 0.001 0.000 200 200 34 366 \"GET http://www.example.com:80/ HTTP/1.1\" \"curl/7.46.0\" - - arn:aws:elasticloadbalancing:us-east-2:123456789012:targetgroup/my-targets/73e2d6bc24d8a067 \"Root=1-58337364-23a8c76965a2ef7629b185e3\" \"-\" \"-\" 0 2018-11-30T22:22:48.364000Z \"forward\" \"-\" \"-\" \"-\" \"-\" \"-\" \"-\""
)

{
  "actions_executed": "forward",
  "chosen_cert_arn": null,
  "classification": null,
  "classification_reason": null,
  "client_host": "192.168.131.39:2817",
  "domain_name": null,
  "elb": "app/my-loadbalancer/50dc6c495c0c9188",
  "elb_status_code": "200",
  "error_reason": null,
  "matched_rule_priority": "0",
  "received_bytes": 34,
  "redirect_url": null,
  "request_creation_time": "2018-11-30T22:22:48.364000Z",
  "request_method": "GET",
  "request_processing_time": 0,
  "request_protocol": "HTTP/1.1",
  "request_url": "http://www.example.com:80/",
  "response_processing_time": 0,
  "sent_bytes": 366,
  "ssl_cipher": null,
  "ssl_protocol": null,
  "target_group_arn": "arn:aws:elasticloadbalancing:us-east-2:123456789012:targetgroup/my-targets/73e2d6bc24d8a067",
  "target_host": null,
  "target_port_list": [],
  "target_processing_time": 0.001,
  "target_status_code": "200",
  "target_status_code_list": [],
  "timestamp": "2018-11-30T22:23:00.186641Z",
  "trace_id": "Root=1-58337364-23a8c76965a2ef7629b185e3",
  "traceability_id": null,
  "type": "http",
  "user_agent": "curl/7.46.0"
}

parse_aws_cloudwatch_log_subscription_message(value: <строка>)
:: <объект>, <ошибка>

# .message -- пример пути к сообщению журнала AWS CloudWatch
parse_aws_cloudwatch_log_subscription_message!(.message)

{
  "log_events": [
    {
      "id": "35683658089614582423604394983260738922885519999578275840",
      "message": "{\"bytes\":26780,\"datetime\":\"14/Sep/2020:11:45:41 -0400\",\"host\":\"192.0.2.1\",\"method\":\"PUT\",\"protocol\":\"HTTP/1.0\",\"referer\":\"https://www.principalcross-platform.io/markets/ubiquitous\",\"request\":\"/expedite/convergence\",\"source_type\":\"stdin\",\"status\":301,\"user-identifier\":\"-\"}",
      "timestamp": "2020-09-14T19:09:29.039Z"
    }
  ],
  "log_group": "test",
  "log_stream": "test",
  "message_type": "DATA_MESSAGE",
  "owner": "111111111111",
  "subscription_filters": [
    "Destination"
  ]
}

parse_aws_vpc_flow_log(value: <строка>, [format: <строка>])
:: <объект> , <ошибка>

parse_aws_vpc_flow_log!("2 123456789010 eni-1235b8ca123456789 - - - - - - - 1431280876 1431280934 - NODATA")

{
  "account_id": "123456789010",
  "action": null,
  "bytes": null,
  "dstaddr": null,
  "dstport": null,
  "end": 1431280934,
  "interface_id": "eni-1235b8ca123456789",
  "log_status": "NODATA",
  "packets": null,
  "protocol": null,
  "srcaddr": null,
  "srcport": null,
  "start": 1431280876,
  "version": 2
}

parse_aws_vpc_flow_log!(
"- eni-1235b8ca123456789 10.0.1.5 10.0.0.220 10.0.1.5 203.0.113.5",
"instance_id interface_id srcaddr dstaddr pkt_srcaddr pkt_dstaddr"
)

{
  "dstaddr": "10.0.0.220",
  "instance_id": null,
  "interface_id": "eni-1235b8ca123456789",
  "pkt_dstaddr": "203.0.113.5",
  "pkt_srcaddr": "10.0.1.5",
  "srcaddr": "10.0.1.5"
}

parse_cef(value: <строка>, [translate_custom_fields: <логическое значение>])
:: <объект> , <ошибка>

parse_cef!(
"CEF:0|CyberArk|PTA|12.6|1|Suspected credentials theft|8|suser=mike2@prod1.example.com shost=prod1.example.com src=198.51.100.0 duser=andy@dev1.example.com dhost=dev1.example.com dst=203.0.113.0 cs1Label=ExtraData cs1=None cs2Label=EventID cs2=52b06812ec3500ed864c461e deviceCustomDate1Label=detectionDate deviceCustomDate1=1388577900000 cs3Label=PTAlink cs3=https://198.51.100.0/incidents/52b06812ec3500ed864c461e cs4Label=ExternalLink cs4=None"
)

{
  "cefVersion": "0",
  "cs1": "None",
  "cs1Label": "ExtraData",
  "cs2": "52b06812ec3500ed864c461e",
  "cs2Label": "EventID",
  "cs3": "https://198.51.100.0/incidents/52b06812ec3500ed864c461e",
  "cs3Label": "PTAlink",
  "cs4": "None",
  "cs4Label": "ExternalLink",
  "deviceCustomDate1": "1388577900000",
  "deviceCustomDate1Label": "detectionDate",
  "deviceEventClassId": "1",
  "deviceProduct": "PTA",
  "deviceVendor": "CyberArk",
  "deviceVersion": "12.6",
  "dhost": "dev1.example.com",
  "dst": "203.0.113.0",
  "duser": "andy@dev1.example.com",
  "name": "Suspected credentials theft",
  "severity": "8",
  "shost": "prod1.example.com",
  "src": "198.51.100.0",
  "suser": "mike2@prod1.example.com"
}

parse_cef!(
"Sep 29 08:26:10 host CEF:1|Security|threatmanager|1.0|100|worm successfully stopped|10|src=198.51.100.0 dst=203.0.113.0 spt=1232"
)

{
  "cefVersion": "1",
  "deviceVendor": "Security",
  "deviceProduct": "threatmanager",
  "deviceVersion": "1.0",
  "deviceEventClassId": "100",
  "name": "worm successfully stopped",
  "severity": "10",
  "src": "198.51.100.0",
  "dst": "203.0.113.0",
  "spt": "1232"
}

parse_cef!(
"CEF:0|Dev|firewall|2.2|1|Connection denied|5|c6a1=2001:0DB8:2CA1:0000:0000:0567:5673:23b5 c6a1Label=Device IPv6 Address",
translate_custom_fields: true
)

{
  "cefVersion": "0",
  "deviceVendor": "Dev",
  "deviceProduct": "firewall",
  "deviceVersion": "2.2",
  "deviceEventClassId": "1",
  "name": "Connection denied",
  "severity": "5",
  "Device IPv6 Address": "2001:0DB8:2CA1:0000:0000:0567:5673:23b5"
}

rv_parse_cef(value: <строка>)
:: <объект>, <ошибка>

rv_parse_cef!(s'CEF:0|Microsoft|Microsoft Windows||Microsoft-Windows-Security-Auditing:4624|An account was successfully logged on.|Low| eventId=1013540004 externalId=4624')

{
  "deviceVendor": "Microsoft",
  "deviceProduct": "Microsoft Windows",
  "deviceVersion": "",
  "deviceEventClassId": "Microsoft-Windows-Security-Auditing:4624",
  "name": "An account was successfully logged on.",
  "severity": "Low",
  "eventId": "1013540004",
  "externalId": "4624"
}

value = r#"<134>1 2022-02-14T03:17:30-08:00 TEST CEF:0|Vendor|Product|20.0.560|600|User Signed In|3|src=192.0.2.255 "#
rv_parse_cef!(value)

{
  ahost: "TEST",
  at: "2022-02-14T03:17:30-08:00",
  deviceProduct: "Product",
  deviceVendor: "Vendor",
  deviceVersion: "20.0.560",
  name: "User Signed In",
  severity: "3",
  signatureId: "600",
  src: "192.0.2.255",
  syslog_facility: "16",
  syslog_priority: "134",
  syslog_severity: "6",
})

parse_common_log(value: <строка>, [timestamp_format: <строка>])
:: <объект> , <ошибка>

parse_common_log!("192.0.2.2 bob frank [10/Oct/2000:13:55:36 -0700] \"GET /apache_pb.gif HTTP/1.0\" 200 2326")

{
  "host": "192.0.2.2",
  "identity": "bob",
  "user": "frank",
  "timestamp": "2000-10-10T20:55:36Z",
  "message": "GET /apache_pb.gif HTTP/1.0",
  "method": "GET",
  "path": "/apache_pb.gif",
  "protocol": "HTTP/1.0",
  "status": 200,
  "size": 2326
}

parse_common_log!(
"192.0.2.25 bob frank [2000-10-10T20:55:36Z] \"GET /apache_pb.gif HTTP/1.0\" 200 2326",
"%+"
)

{
  "host": "192.0.2.25",
  "identity": "bob",
  "user": "frank",
  "timestamp": "2000-10-10T20:55:36Z",
  "message": "GET /apache_pb.gif HTTP/1.0",
  "method": "GET",
  "path": "/apache_pb.gif",
  "protocol": "HTTP/1.0",
  "status": 200,
  "size": 2326
}

rv_extract_from_dit(value: <строка>)
:: <строка>, <ошибка>

rv_extract_from_dit!("CN=Dev-India,OU=Distribution Groups,DC=gp,DC=gl,DC=example,DC=com")

{
  "domain": "gp.gl.example.com",
  "username": "dev-india"
}

parse_etld(value: <строка>, [plus_parts: <целое число>, psl: <строка>])
:: <объект>, <ошибка>

{
  "etld": "ac.uk",
  "etld_plus": "example.ac.uk",
  "known_suffix": true
}

parse_etld!("sub.example.com")

{
  "etld": "com",
  "etld_plus": "com",
  "known_suffix": true
}

parse_etld!("example.com", plus_parts: 1)

{
  "etld": "com",
  "etld_plus": "example.com",
  "known_suffix": true
}

parse_etld!("example.acmecorp")

{
  "etld": "acmecorp",
  "etld_plus": "acmecorp",
  "known_suffix": false
}

parse_etld!("example.acmecorp",
# пример пути к списку доменов
psl: "resources/public_suffix_list.dat")

{
  "etld": "acmecorp",
  "etld_plus": "acmecorp",
  "known_suffix": false
}

dns_lookup(value: <строка>, [qtype: <строка>, qclass: <строка>, options: <объект>])
:: <объект> , <ошибка>

res = dns_lookup!("dns.google")
# сбросить нестатический ttl, так что результат статический
res.answers = map_values(res.answers) -> |value| {
value.ttl = 600
value
}
# удалить дополнительные ответы
res.answers = filter(res.answers) -> |_, value| {
value.rData == "8.8.8.8"
}
# удалить класс, поскольку он динамический
res.additional = map_values(res.additional) -> |value| {
del(value.class)
value
}
res

{
  "additional": [
    {
      "domainName": "",
      "rData": "OPT ...",
      "recordType": "OPT",
      "recordTypeId": 41,
      "ttl": 0
    }
  ],
  "answers": [
    {
      "class": "IN",
      "domainName": "dns.google",
      "rData": "8.8.8.8",
      "recordType": "A",
      "recordTypeId": 1,
      "ttl": 600
    }
  ],
  "authority": [],
  "fullRcode": 0,
  "header": {
    "aa": false,
    "ad": false,
    "anCount": 2,
    "arCount": 1,
    "cd": false,
    "nsCount": 0,
    "opcode": 0,
    "qdCount": 1,
    "qr": true,
    "ra": true,
    "rcode": 0,
    "rd": true,
    "tc": false
  },
  "question": [
    {
      "class": "IN",
      "domainName": "dns.google",
      "questionType": "A",
      "questionTypeId": 1
    }
  ],
  "rcodeName": "NOERROR"
}

res = dns_lookup!("dns.google", class: "IN", qtype: "A")
# сбросить нестатический ttl, так что результат статический
res.answers = map_values(res.answers) -> |value| {
  value.ttl = 600
  value
}
#удалить дополнительные ответы
res.answers = filter(res.answers) -> |_, value| {
    value.rData == "8.8.8.8"
}
# удалить класс, поскольку он динамический
res.additional = map_values(res.additional) -> |value| {
    del(value.class)
    value
}
res

{
  "additional": [
    {
      "domainName": "",
      "rData": "OPT ...",
      "recordType": "OPT",
      "recordTypeId": 41,
      "ttl": 0
    }
  ],
  "answers": [
    {
      "class": "IN",
      "domainName": "dns.google",
      "rData": "8.8.8.8",
      "recordType": "A",
      "recordTypeId": 1,
      "ttl": 600
    }
  ],
  "authority": [],
  "fullRcode": 0,
  "header": {
    "aa": false,
    "ad": false,
    "anCount": 2,
    "arCount": 1,
    "cd": false,
    "nsCount": 0,
    "opcode": 0,
    "qdCount": 1,
    "qr": true,
    "ra": true,
    "rcode": 0,
    "rd": true,
    "tc": false
  },
  "question": [
    {
      "class": "IN",
      "domainName": "dns.google",
      "questionType": "A",
      "questionTypeId": 1
    }
  ],
  "rcodeName": "NOERROR"
}

res = dns_lookup!("dns.google", options: {"timeout": 30, "attempts": 5})
# сбросить нестатический ttl, так что результат статический
res.answers = map_values(res.answers) -> |value| {
value.ttl = 600
value
}
# удалить дополнительные ответы
res.answers = filter(res.answers) -> |_, value| {
value.rData == "8.8.8.8"
}
# удалить класс, поскольку он динамический
res.additional = map_values(res.additional) -> |value| {
del(value.class)
value
}
res

{
  "additional": [
    {
      "domainName": "",
      "rData": "OPT ...",
      "recordType": "OPT",
      "recordTypeId": 41,
      "ttl": 0
    }
  ],
  "answers": [
    {
      "class": "IN",
      "domainName": "dns.google",
      "rData": "8.8.8.8",
      "recordType": "A",
      "recordTypeId": 1,
      "ttl": 600
    }
  ],
  "authority": [],
  "fullRcode": 0,
  "header": {
    "aa": false,
    "ad": false,
    "anCount": 2,
    "arCount": 1,
    "cd": false,
    "nsCount": 0,
    "opcode": 0,
    "qdCount": 1,
    "qr": true,
    "ra": true,
    "rcode": 0,
    "rd": true,
    "tc": false
  },
  "question": [
    {
      "class": "IN",
      "domainName": "dns.google",
      "questionType": "A",
      "questionTypeId": 1
    }
  ],
  "rcodeName": "NOERROR"
}

res = dns_lookup!("dns.google", options: {"servers": ["dns.quad9.net"]})
# сбросить нестатический ttl, так что результат статический
res.answers = map_values(res.answers) -> |value| {
value.ttl = 600
value
}
# удалить дополнительные ответы
res.answers = filter(res.answers) -> |_, value| {
value.rData == "8.8.8.8"
}
# удалить класс, поскольку он динамический
res.additional = map_values(res.additional) -> |value| {
del(value.class)
value
}
res

{
  "additional": [
  {
    "domainName": "",
    "rData": "OPT ...",
    "recordType": "OPT",
    "recordTypeId": 41,
    "ttl": 0
  }
  ],
  "answers": [
    {
      "class": "IN",
      "domainName": "dns.google",
      "rData": "8.8.8.8",
      "recordType": "A",
      "recordTypeId": 1,
      "ttl": 600
    }
  ],
  "authority": [],
  "fullRcode": 0,
  "header": {
  "aa": false,
  "ad": false,
  "anCount": 2,
  "arCount": 1,
  "cd": false,
  "nsCount": 0,
  "opcode": 0,
  "qdCount": 1,
  "qr": true,
  "ra": true,
  "rcode": 0,
  "rd": true,
  "tc": false
  },
  "question": [
    {
      "class": "IN",
      "domainName": "dns.google",
      "questionType": "A",
      "questionTypeId": 1
    }
  ],
  "rcodeName": "NOERROR"
}

parse_glog(value: <строка>)
:: <объект> , <ошибка>

parse_glog!("I20210131 14:48:54.411655 15520 main.c++:9] Hello world!")

{
  "file": "main.c++",
  "id": 15520,
  "level": "info",
  "line": 9,
  "message": "Hello world!",
  "timestamp": "2021-01-31T14:48:54.411655Z"
}

parse_grok(value: <строка>, pattern: <строка>)
:: <объект> , <ошибка>

parse_grok!(
"2020-10-02T23:22:12.223222Z info Hello world",
"%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:level} %{GREEDYDATA:message}"
)

{
  "level": "info",
  "message": "Hello world",
  "timestamp": "2020-10-02T23:22:12.223222Z"
}

parse_groks(value: <строка>, patterns: <массив>, [aliases: <объект>])
:: <объект> , <ошибка>

parse_groks!(
"2020-10-02T23:22:12.223222Z info Hello world",
patterns: [
"%{common_prefix} %{_status} %{_message}",
"%{common_prefix} %{_message}",
],
aliases: {
"common_prefix": "%{_timestamp} %{_loglevel}",
"_timestamp": "%{TIMESTAMP_ISO8601:timestamp}",
"_loglevel": "%{LOGLEVEL:level}",
"_status": "%{POSINT:status}",
"_message": "%{GREEDYDATA:message}"
})

{
  "level": "info",
  "message": "Hello world",
  "timestamp": "2020-10-02T23:22:12.223222Z"
}

parse_influxdb(value: <строка> )
:: <массив> , <ошибка>

parse_influxdb!("cpu,host=A,region=us-west usage_system=64i,usage_user=10u,temperature=50.5,on=true,sleep=false 1590488773254420000")

[
  {
    "gauge": {
      "value": 64
    },
    "kind": "absolute",
    "name": "cpu_usage_system",
    "tags": {
      "host": "A",
      "region": "us-west"
    },
    "timestamp": "2020-05-26T10:26:13.254420Z"
  },
  {
    "gauge": {
      "value": 10
    },
    "kind": "absolute",
    "name": "cpu_usage_user",
    "tags": {
      "host": "A",
      "region": "us-west"
    },
    "timestamp": "2020-05-26T10:26:13.254420Z"
  },
  {
    "gauge": {
      "value": 50.5
    },
    "kind": "absolute",
    "name": "cpu_temperature",
    "tags": {
      "host": "A",
      "region": "us-west"
    },
    "timestamp": "2020-05-26T10:26:13.254420Z"
  },
  {
    "gauge": {
      "value": 1
    },
    "kind": "absolute",
    "name": "cpu_on",
    "tags": {
      "host": "A",
      "region": "us-west"
    },
    "timestamp": "2020-05-26T10:26:13.254420Z"
  },
  {
    "gauge": {
      "value": 0
    },
    "kind": "absolute",
    "name": "cpu_sleep",
    "tags": {
      "host": "A",
      "region": "us-west"
    },
    "timestamp": "2020-05-26T10:26:13.254420Z"
  }
]

parse_klog(value: <строка>)
:: <объект> , <ошибка>

parse_klog!("I0505 17:59:40.692994 28133 klog.go:70] hello from klog")

{
  "file": "klog.go",
  "id": 28133,
  "level": "info",
  "line": 70,
  "message": "hello from klog",
  "timestamp": "2024-05-05T17:59:40.692994Z"
}

rv_parse_leef(value: <строка>)
:: <объект>, <ошибка>

rv_parse_leef!("<13>1 2024-07-18T11:07:53.520Z 192.168.1.1 LEEF:2.0|Microsoft|MSExchange|2007|7732|^|dvchost=www.example.com^msg=io\t|p")

{
  "syslog_facility": "1",
  "syslog_priority": "13",
  "syslog_severity": "5",
  "at": "2024-07-18T11:07:53.520Z",
  "ahost": "192.168.1.1",
  "dvchost": "www.example.com",
  "msg": "io\t|p",
  "deviceVendor": "Microsoft",
  "eventName": "7732",
  "productName": "MSExchange",
  "productVersion": "2007",
}

parse_linux_authorization(value: <строка>)
:: <объект> , <ошибка>

parse_linux_authorization!(
s'Mar 23 01:49:58 localhost sshd[1111]: Accepted publickey for eng from 	198.51.100.1 port 8888 ssh2: RSA SHA256:foobar'
)

{
  "appname": "sshd",
  "hostname": "localhost",
  "message": "Accepted publickey for eng from 198.51.100.1 port 8888 ssh2: RSA SHA256:foobar",
  "procid": 1111,
  "timestamp": "2023-03-23T01:49:58Z"
}

parse_logfmt(value: <строка>)
:: <объект> , <ошибка>

parse_logfmt!(
"@timestamp=\"Sun Jan 10 16:47:39 EST 2021\" level=info msg=\"Stopping all fetchers\" tag#production=stopping_fetchers id=ConsumerFetcherManager-1382721708341 module=kafka.consumer.ConsumerFetcherManager"
)

{
  "@timestamp": "Sun Jan 10 16:47:39 EST 2021",
  "id": "ConsumerFetcherManager-1382721708341",
  "level": "info",
  "module": "kafka.consumer.ConsumerFetcherManager",
  "msg": "Stopping all fetchers",
  "tag#production": "stopping_fetchers"
}

rv_parse_msgpack(value: <строка>)
:: <объект>, <ошибка>

# .message -- массив байтов [135, 163, 105, 110, 116, 1, 165, 102, 108, 111, 97, 116, 203, 63, 224, 0, 0, 0, 0, 0, 0, 167, 98, 111, 111, 108, 101, 97, 110, 195, 164, 110, 117, 108, 108, 192, 166, 115, 116, 114, 105, 110, 103, 167, 102, 111, 111, 32, 98, 97, 114, 165, 97, 114, 114, 97, 121, 146, 163, 102, 111, 111, 163, 98, 97, 114, 166, 111, 98, 106, 101, 99, 116, 130, 163, 102, 111, 111, 1, 163, 98, 97, 122, 203, 63, 224, 0, 0, 0, 0, 0, 0,]
rv_parse_msgpack!(.message)

{
  "int": 1,
  "float": 0.5,
  "boolean": true,
  "null": null,
  "string": "foo bar",
  "array": [
    "foo",
    "bar"
  ],
  "object": {
    "foo": 1,
    "baz": 0.5
}

rv_parse_msgpack!(decode_base64!("3wAAAAGlZmllbGSldmFsdWU="))

{
  "field": "value"
}

rv_parse_msgpack_batch(value: <строка>)
:: <массив объектов>, <ошибка>

# .message -- массив байтов [135, 163, 105, 110, 116, 1, 165, 102, 108, 111, 97, 116, 203, 63, 224, 0, 0, 0, 0, 0, 0, 167, 98, 111, 111, 108, 101, 97, 110, 195, 164, 110, 117, 108, 108, 192, 166, 115, 116, 114, 105, 110, 103, 167, 102, 111, 111, 32, 98, 97, 114, 165, 97, 114, 114, 97, 121, 146, 163, 102, 111, 111, 163, 98, 97, 114, 166, 111, 98, 106, 101, 99, 116, 130, 163, 102, 111, 111, 1, 163, 98, 97, 122, 203, 63, 224, 0, 0, 0, 0, 0, 0, 135, 163, 105, 110, 116, 1, 165, 102, 108, 111, 97, 116, 203, 63, 224, 0, 0, 0, 0, 0, 0, 167, 98, 111, 111, 108, 101, 97, 110, 195, 164, 110, 117, 108, 108, 192, 166, 115, 116, 114, 105, 110, 103, 167, 102, 111, 111, 32, 98, 97, 114, 165, 97, 114, 114, 97, 121, 146, 163, 102, 111, 111, 163, 98, 97, 114, 166, 111, 98, 106, 101, 99, 116, 130, 163, 102, 111, 111, 1, 163, 98, 97, 122, 203, 63, 224, 0, 0, 0, 0, 0, 0,]
rv_parse_msgpack_batch!(.message)

[
  {
    "int": 1,
    "float": 0.5,
    "boolean": true,
    "null": null,
    "string": "foo bar",
    "array": [
      "foo",
      "bar"
    ],
    "object": {
      "foo": 1,
      "baz": 0.5
    }
  },
  {
    "int": 1,
    "float": 0.5,
    "boolean": true,
    "null": null,
    "string": "foo bar",
    "array": [
      "foo",
      "bar"
    ],
    "object": {
      "foo": 1,
      "baz": 0.5
    }
  }
]

rv_parse_msgpack_batch(decode_base64!("3wAAAAGlZmllbGSldmFsdWXfAAAAAaVmaWVsZKV2YWx1ZQ=="))

[
  {
    "field": "value"
  },
  {
    "field": "value"
  }
]

rv_parse_netflow(value: <строка>)
:: <массив объектов>, <ошибка>

rv_parse_netflow!(decode_base64!("AAUCAAMABAAFAAYHCAkAAQIDBAUGBwgJAAECAwQFBgcICQABAgMEBQYHCAkAAQIDBAUGBwgJAAECAwQFBgcICQABAgMEBQYH"))

[
  {
    "V5": {
      "body": {
        "d_octets": 66051,
        "d_pkts": 101124105,
        "dst_addr": "4.5.6.7",
        "dst_as": 515,
        "dst_mask": 5,
        "dst_port": 1029,
        "first": {
          "nanos": 87000000,
          "secs": 67438
        },
        "input": 515,
        "last": {
          "nanos": 553000000,
          "secs": 134807
        },
        "next_hop": "8.9.0.1",
        "output": 1029,
        "pad1": 6,
        "pad2": 1543,
        "protocol_number": 8,
        "protocol_type": "EGP",
        "src_addr": "0.1.2.3",
        "src_as": 1,
        "src_mask": 4,
        "src_port": 515,
        "tcp_flags": 7,
        "tos": 9
      },
      "header": {
        "count": 512,
        "engine_id": 7,
        "engine_type": 6,
        "flow_sequence": 33752069,
        "sampling_interval": 2057,
        "sys_up_time": {
          "nanos": 672000000,
          "secs": 50332
        },
        "unix_nsecs": 134807553,
        "unix_secs": 83887623,
        "version": 5
      }
    }
  }
]

parse_nginx_log(value: <строка>, format: <строка>, [timestamp_format: <строка>])
:: <объект> , <ошибка>

parse_nginx_log!(
s'203.0.113.1 - alice [01/Apr/2021:12:02:31 +0000] "POST /not-found HTTP/1.1" 404 153 "http://localhost/somewhere" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.119 Safari/537.36" "2.75"',
"combined",
)

{
  "client": "203.0.113.1",
  "user": "alice",
  "timestamp": "2021-04-01T12:02:31Z",
  "request": "POST /not-found HTTP/1.1",
  "method": "POST",
  "path": "/not-found",
  "protocol": "HTTP/1.1",
  "status": 404,
  "size": 153,
  "referer": "http://localhost/somewhere",
  "agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.119 Safari/537.36",
  "compression": "2.75"
}

parse_nginx_log!(
s'2021/04/01 13:02:31 [error] 31#31: *1 open() "/usr/share/nginx/html/not-found" failed (2: No such file or directory), client: 203.0.113.1, server: localhost, request: "POST /not-found HTTP/1.1", host: "localhost:8081"',
"error"
)

{
  "timestamp": "2021-04-01T13:02:31Z",
  "severity": "error",
  "pid": 31,
  "tid": 31,
  "cid": 1,
  "message": "open() \"/usr/share/nginx/html/not-found\" failed (2: No such file or directory)",
  "client": "203.0.113.1",
  "server": "localhost",
  "request": "POST /not-found HTTP/1.1",
  "host": "localhost:8081"
}

parse_proto(value: <строка>, desc_file: <строка>, message_type: <строка>)
:: <объект>, <ошибка>

.payload = encode_base64(encode_proto!({"name": "someone", "phones": [{"number": "123456"}]}, "resources/protobuf_descriptor_set.desc", "test_protobuf.Person"))

Cgdzb21lb25lIggKBjEyMzQ1Ng==

rv_parse_qradar(value: <строка>)
:: <объект>, <ошибка>

rv_parse_msgpack!("AgentDevice=WindowsLog\tAgentLogFile=Security\tPluginVersion=7.2.9.105\tSource=Microsoft-Windows-Security-Auditing\tComputer=dc04.lab2012.local\tOriginatingComputer=192.0.2.0\tUser=\tDomain=\tEventID=4624\tEventIDCode=4624\tEventType=8\tEventCategory=12544\tRecordNumber=11103971\tTimeGenerated=1610705793\tTimeWritten=1610705793\tLevel=Log Always\tKeywords=Audit Success\tTask=SE_ADT_LOGON_LOGON\tOpcode=Info\tMessage=Вход с учетной записью выполнен успешно.  Субъект:  ИД безопасности:  NULL SID  Имя учетной записи:  -  Домен учетной записи:  -  Код входа:  0x0  Тип входа:   3  Уровень олицетворения:  Делегирование  Новый вход:  ИД безопасности:  NT AUTHORITY\\СИСТЕМА  Имя учетной записи:  USER  Домен учетной записи:  LAB2012  Код входа:  0x1E6112B9  GUID входа:  {06457096-03A4-55FB-28EA-9882B565E681}  Сведения о процессе:  Идентификатор процесса:  0x0  Имя процесса:  -  Сведения о сети:  Имя рабочей станции: -  Сетевой адрес источника: fe80::7830:1b00:4e5f:1300  Порт источника:  51755  Данное событие возникает при создании сеанса входа.\n".as_bytes())

{
  "AgentDevice": "WindowsLog",
  "AgentLogFile": "Security",
  "PluginVersion": "7.2.9.105",
  "Source": "Microsoft-Windows-Security-Auditing",
  "Computer": "dc04.lab2012.local",
  "OriginatingComputer": "192.0.2.0"
  "User": ""
  "Domain": ""
  "EventID": "4624"
  "EventIDCode": "4624"
  "EventType": "8"
  "EventCategory": "12544"
  "RecordNumber": "11103971"
  "TimeGenerated": "1610705793"
  "TimeWritten": "1610705793"
  "Level": "Log Always"
  "Keywords": "Audit Success"
  "Task": "SE_ADT_LOGON_LOGON"
  "Opcode": "Info"
  "Message": {
    "Вход с учетной записью выполнен успешно.": "",
    "Субъект": "ИД безопасности: NULL SID",
    "Имя учетной записи": "-",
    "Домен учетной записи": "-",
    "Код входа": "0x0",
    "Тип входа": "3",
    "Уровень олицетворения": "Делегирование",
    "Новый вход": {
      "ИД безопасности": "NT AUTHORITY\\СИСТЕМА",
      "Имя учетной записи": "USER",
      "Домен учетной записи": "LAB2012",
      "Код входа": "0x1E6112B9",
      "GUID входа": "{06457096-03A4-55FB-28EA-9882B565E681}"
    },
    "Сведения о процессе": {
      "Идентификатор процесса": "0x0",
      "Имя процесса": "-"
    },
    "Сведения о сети": {
      "Имя рабочей станции": "-",
      "Сетевой адрес источника": "2001:DB8::7830:1b00:4e5f:1300",
      "Порт источника": "51755"
    }
  }
}

rv_parse_msgpack!("<13>Jan 15 13:16:35 DC04  AgentDevice=WindowsLog\tAgentLogFile=Security\tPluginVersion=7.2.9.105\tSource=Microsoft-Windows-Security-Auditing\tComputer=dc04.lab2012.local\tOriginatingComputer=192.0.2.0\tUser=\tDomain=\tEventID=4624\tEventIDCode=4624\tEventType=8\tEventCategory=12544\tRecordNumber=11103971\tTimeGenerated=1610705793\tTimeWritten=1610705793\tLevel=Log Always\tKeywords=Audit Success\tTask=SE_ADT_LOGON_LOGON\tOpcode=Info\n".as_bytes())

{
  "syslog_facility": "1",
  "syslog_priority": "13",
  "syslog_severity": "5",
  "at": "Jan 15 13:16:35",
  "ahost": "DC04",
  "AgentDevice": "WindowsLog",
  "AgentLogFile": "Security",
  "PluginVersion": "7.2.9.105",
  "Source": "Microsoft-Windows-Security-Auditing",
  "Computer": "dc04.lab2012.local",
  "OriginatingComputer": "192.0.2.0"
  "User": ""
  "Domain": ""
  "EventID": "4624"
  "EventIDCode": "4624"
  "EventType": "8"
  "EventCategory": "12544"
  "RecordNumber": "11103971"
  "TimeGenerated": "1610705793"
  "TimeWritten": "1610705793"
  "Level": "Log Always"
  "Keywords": "Audit Success"
  "Task": "SE_ADT_LOGON_LOGON"
  "Opcode": "Info"
}

parse_syslog(value: <строка>)
:: <объект> , <ошибка>

parse_syslog!(
s'<13>1 2020-03-13T20:45:38.119Z example.name non 2426 ID931 [exampleSDID@32473 iut="3" eventSource= "Application" eventID="1011"] Try to override the THX port, maybe it will reboot the neural interface!'
)

{
  "severity": "notice",
  "facility": "user",
  "timestamp": "2020-03-13T20:45:38.119Z",
  "hostname": "example.name",
  "appname": "non",
  "procid": 2426,
  "msgid": "ID931",
  "message": "Try to override the THX port, maybe it will reboot the neural interface!",
  "exampleSDID@32473": {
    "eventID": "1011",
    "eventSource": "Application",
    "iut": "3"
  },
  "version": 1
}

to_syslog_facility(value: <целое число>)
:: <строка> , <ошибка>

to_syslog_facility!(4)

auth

to_syslog_level(value: <целое число>)
:: <строка> , <ошибка>

to_syslog_level!(5)

notice

to_syslog_severity(value: <строка>)
:: <целое число> , <ошибка>

to_syslog_severity!("alert")

1

parse_csv(value: <строка>, [delimiter: <строка>])
:: <массив> , <ошибка>

parse_csv!("foo,bar,\"foo \"\", bar\"")

[
  "foo",
  "bar",
  "foo \", bar"
]

parse_csv!("foo bar", delimiter: " ")

[
  "foo",
  "bar"
]

rv_parse_html(value: <строка>, [trim: <логическое значение>, attr_prefix: <строка>, text_key: <строка>, always_use_text_key: <логическое значение>, parse_bool: <логическое значение>, parse_null: <логическое значение>, parse_number: <логическое значение>])
:: <объект>, <ошибка>

value = s'<book category="PROGRAMMING"> <title lang="en">The Rust programming language</title> <author>Steve Klabnik, Carol Nichols</author> <year>2019</year></book>'
rv_parse_html!(value,
text_key: "value",
parse_number: false)

{
  "book": {
    "@category": "PROGRAMMING",
    "author": "Steve Klabnik, Carol Nichols",
    "title": {
      "@lang": "en",
      "value": "The Rust programming language"
    },
    "year": "2019"
  }
}

value = s'<b>test</b>'
rv_parse_html!(value,
text_key: "value",
text_key: "node",
always_use_text_key: true)

{
  "b": {
    "node": "test"
  }
}

value = s'<root>  <a>test</a>  </root>'
rv_parse_html!(value, trim: false)

{
  "root": {
    "a": "test",
    "text": [
      "  ",
      "  "
    ]
  }
}

parse_json(value: <строка>, [max_depth: <целое число>, lossy: <логическое значение>])
:: <логическое значение | целое число | число с плавающей точкой | строка | объект | массив | пустое значение> , <ошибка>

parse_json!("{\"key\": \"val\"}")

{
  "key": "val"
}

parse_json!("{\"top_level\":{\"key\": \"val\"}}",
max_depth: 1)

{
  "top_level": "{\"key\": \"val\"}"
}

rv_json_extract_payload(value: <строка>, payload_key: <строка>)
:: <логическое значение | целое число | число с плавающей точкой | строка | объект | массив | пустое значение>, <ошибка>

rv_json_extract_payload(s'{"a": 123, "payload"    : "data"}',
payload_key: "payload")

"data"

rv_json_extract_payload(s'"asd":123,"payload" : "text"',
payload_key: "payload")

"text"

rv_json_extract_payload(s'{ asd":123,"payload" : "first", "payload": "second" }', payload_key: "payload")

"first"

parse_key_value(value: <строка>, [key_value_delimiter: <строка>, field_delimiter: <строка>, whitespace: <строка>, accept_standalone_key: <логическое значение>])
:: <объект> , <ошибка>

parse_key_value!(
"@timestamp=\"Sun Jan 10 16:47:39 EST 2021\" level=info msg=\"Stopping all fetchers\" tag#production=stopping_fetchers id=ConsumerFetcherManager-1382721708341 module=kafka.consumer.ConsumerFetcherManager"
)

{
  "@timestamp": "Sun Jan 10 16:47:39 EST 2021",
  "level": "info",
  "msg": "Stopping all fetchers",
  "tag#production": "stopping_fetchers",
  "id": "ConsumerFetcherManager-1382721708341",
  "module": "kafka.consumer.ConsumerFetcherManager"
}

parse_key_value!(
"path:\"/cart_link\", host:store.app.com, fwd: \"203.0.113.16\", dyno: web.1, connect:0ms, service:87ms, status:304, bytes:632, protocol:https",
field_delimiter: ",",
key_value_delimiter: ":"
)

{
  "path": "/cart_link",
  "host": "store.app.com",
  "fwd": "203.0.113.16",
  "dyno": "web.1",
  "connect": "0ms",
  "service": "87ms",
  "status": "304",
  "bytes": "632",
  "protocol": "https"
}

parse_key_value!(
"env:prod,service:backend,region:eu-east1,beta",
field_delimiter: ",",
key_value_delimiter: ":",
)

{
  "env": "prod",
  "service": "backend",
  "region": "eu-east1",
  "beta": true
}

parse_key_value!(
"at=info,method=GET,path=\"/index\",status=200,tags=dev,tags=dummy",
field_delimiter: ",",
key_value_delimiter: "=",
)

{
  "at": "info",
  "method": "GET",
  "path": "/index",
  "status": "200",
  "tags": [
    "dev",
    "dummy"
  ]
}

parse_ruby_hash(value: <строка>)
:: <объект> , <ошибка>

parse_ruby_hash!(s'{ "test" => "value", "testNum" => 0.2, "testObj" => { "testBool" => true, "testNull" => nil } }')

{
  "test": "value",
  "testNum": 0.2,
  "testObj": {
    "testBool": true,
    "testNull": null
  }
}

parse_xml(value: <строка>, [include_attr: <логическое значение>, attr_prefix: <строка>, text_key: <строка>, always_use_text_key: <логическое значение>, parse_bool: <логическое значение>, parse_null: <логическое значение>, parse_number: <логическое значение>])
:: <объект> , <ошибка>

value = s'<book category="CHILDREN"><title lang="en">Harry Potter</title><author>J K. Rowling</author><year>2005</year></book>'

parse_xml!(value, text_key: "value", parse_number: false)

{
  "book": {
    "@category": "CHILDREN",
    "author": "J K. Rowling",
    "title": {
      "@lang": "en",
      "value": "Harry Potter"
    },
    "year": "2005"
  }
}

parse_duration(value: <строка>, unit: <строка>)
:: <число с плавающей точкой> , <ошибка>

parse_duration!("1005ms", unit: "s")

1.005

parse_query_string(value: <строка>)
:: <объект>

parse_query_string("foo=%2B1&bar=2&bar=3&xyz")

{
  "bar": [
    "2",
    "3"
  ],
  "foo": "+1",
  "xyz": ""
}

parse_query_string("?foo%5b%5d=1&foo%5b%5d=2")

{
  "foo[]": [
    "1",
    "2"
  ]
}

parse_tokens(value: <строка>)
:: <массив> , <ошибка>

parse_tokens(
"A sentence \"with \\\"a\\\" sentence inside\" and [some brackets]"
)

[
  "A",
  "sentence",
  "with \\\"a\\\" sentence inside",
  "and",
  "some brackets"
]

parse_url(value: <строка>, [default_known_ports: <логическое значение>])
:: <объект> , <ошибка>

parse_url!("ftp://foo:bar@example.com:4343/foobar?hello=world#123")

{
  "scheme": "ftp",
  "username": "foo",
  "password": "bar",
  "host": "example.com",
  "port": 4343,
  "path": "/foobar",
  "query": {
    "hello": "world"
  },
  "fragment": "123"
}

parse_url!("https://example.com", default_known_ports: true)

{
  "scheme": "https",
  "username": "",
  "password": "",
  "host": "example.com",
  "port": 443,
  "path": "/",
  "query": {},
  "fragment": null
}

parse_user_agent(value: <строка>, [mode: <строка>])
:: <объект>

parse_user_agent(
"Mozilla Firefox 1.0.1 Mozilla/5.0 (X11; U; Linux i686; de-DE; rv:1.7.6) Gecko/20050223 Firefox/1.0.1"
)

{
  "browser": {
    "family": "Firefox",
    "version": "1.0.1"
  },
  "device": {
    "category": "pc"
  },
  "os": {
    "family": "Linux",
    "version": null
  }
}

parse_user_agent(
"Mozilla/4.0 (compatible; MSIE 7.66; Windows NT 5.1; SV1; .NET CLR 1.1.4322)",
mode: "reliable"
)

{
  "browser": {
    "family": "Internet Explorer",
    "version": "7.66"
  },
  "device": {
    "category": "pc"
  },
  "os": {
    "family": "Windows XP",
    "version": "NT 5.1"
  }
}

parse_user_agent(
"Opera/9.80 (J2ME/MIDP; Opera Mini/4.3.24214; iPhone; CPU iPhone OS 4_2_1 like Mac OS X; AppleWebKit/24.783; U; en) Presto/2.5.25 Version/10.54",
mode: "enriched"
)

{
  "browser": {
    "family": "Opera Mini",
    "major": "4",
    "minor": "3",
    "patch": "24214",
    "version": "10.54"
  },
  "device": {
    "brand": "Apple",
    "category": "smartphone",
    "family": "iPhone",
    "model": "iPhone"
  },
  "os": {
    "family": "iOS",
    "major": "4",
    "minor": "2",
    "patch": "1",
    "patch_minor": null,
    "version": "4.2.1"
  }
}

ip_aton(value: <строка>)
:: <целое число> , <ошибка>

ip_aton!("233.252.0.4")

3925606404

ip_cidr_contains(cidr: <строка>, ip: <строка>)
:: <логическое значение> , <ошибка>

ip_cidr_contains!("203.0.113.0/24", "203.0.113.32")

true

ip_cidr_contains!("2001:db8:4:ba::/64", "2001:db8:4:ba:2e0:81ff:fe22:d1f1")

true

ip_ntoa(value: <строка>)
:: <строка> , <ошибка>

ip_ntoa!(3925606404)

233.252.0.4

ip_ntop(value: <строка>)
:: <строка> , <ошибка>

ip_ntop!(decode_base64!("wKgAAQ=="))

192.168.0.1

ip_ntop!(decode_base64!("IAENuIWjAAAAAIouA3BzNA=="))

2001:db8:85a3::8a2e:370:7334

ip_pton(value: <строка>)
:: <строка> , <ошибка>

encode_base64(ip_pton!("192.168.0.1"))

wKgAAQ==

encode_base64(ip_pton!("2001:db8:85a3::8a2e:370:7334"))

IAENuIWjAAAAAIouA3BzNA==

ip_subnet(ip: <строка>, subnet: <строка>)
:: <строка> , <ошибка>

ip_subnet!("192.168.10.32", "255.255.255.0")

192.168.10.0

ip_subnet!("2404:6800:4003:c02::64", "/32")

2404:6800::

ip_to_ipv6(ip: <строка>)
:: <строка> , <ошибка>

ip_to_ipv6!("192.168.10.32")

::ffff:192.168.10.32

ipv6_to_ipv4(ip: <строка>)
:: <строка> , <ошибка>

ipv6_to_ipv4!("::ffff:192.168.0.1")

192.168.0.1