simple_flex_parser
<parsers xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="parsers.xsd">
<parser name="simple_parser" desc="simple parser in flex">
<declaration>
<token name="tokenFoo" value="FOO" options="linestart"/>
<token name="tokenBar" value="BAR"/> <!-- "BAR" in hex -->
<number name="parser_state" scope="session"/>
<number name="num_temp" scope="stream"/>
<string name="string_temp" scope="stream"/>
<meta name="meta_action" key="action" format="text"/>
<meta name="meta_alert" key="alert" format="text"/>
</declaration>
<match name="tokenFoo">
<!-- move 4 bytes forward -->
<move value="4">
<!-- find the end of the line -->
<find name="num_temp" value="
" length="80">
<!-- read up to the end of the line -->
<read name="string_temp" length="$num_temp">
<!-- register what was read as action meta -->
<register name="meta_action" value="$string_temp"/>
<!-- flag that we read something -->
<assign name="parser_state" value="1"/>
</read>
</find>
</move>
</match>
<match name="tokenBar">
<!-- if we've already matched "FOO" and read something, register an alert now -->
<if name="parser_state" equal="1">
<register name="meta_alert" value="saw foo and bar"/>
</if>
</match>
</parser>
</parsers>
simple parser lua
local simple = nw.createParser("simple_parser", "simple parser in lua")
-- declare the meta keys we'll be registering meta with
simple:setKeys({
nwlanguagekey.create("action"),
nwlanguagekey.create("alert"),
})
function simple:sessionBegin()
-- reset parser_state for the new session
self.parser_state = nil
end
function simple:tokenFoo(token, first, last)
-- set position to byte after the token
current_position = last + 1
-- get the payload
local payload = nw.getPayload()
-- make sure we have bytes to move through
if current_position + 4 <= payload:len() then
-- move 4 bytes forward
current_position = current_position + 4
-- find the end of the line
local num_temp = payload:find("\13\10", current_position, current_position + 80)
-- if we found the end of the line
if num_temp ~= nil then
-- we don't want to read the \13
num_temp = num_temp - 1
-- read up to the end of the line
local string_temp = payload:tostring(current_position, num_temp)
-- make sure the read succeeded
if string_temp ~= nil then
-- register what was read as action meta
nw.createMeta(self.keys.action, string_temp)
-- flag that we read something
self.parser_state = 1
end
end
end
end
function simple:tokenBar(token, first, last)
-- if we've already matched "FOO" and read something, register an alert now
if self.parser_state == 1 then
nw.createMeta(self.keys.alert, "saw foo and bar")
end
end
-- declare what tokens and events we want to match
simple:setCallbacks({
[nwevents.OnSessionBegin] = simple.sessionBegin,
["FOO"] = simple.tokenFoo,
["\66\65\82"] = simple.tokenBar, -- "BAR" in hex
})
