Parsers

[CristianoAlves]

H, 

I need understand, if exist the possible for crerate a new field for this logs :

{"User":"00006063180","Password":"34831123"}

we need create a field (meta) with 

User: 

Password

[CristianoAlves]

When in "Investigation" with field i search correct Query for this events ?

[WilliamMotley1]

I see the problem

In the original, change the line:

      if user and password then

to:

      if userString and passwordString then

[CristianoAlves]

[WilliamMotley1]

You can take the logging statements out - that's where that error is coming from.

[CristianoAlves]

Motley, Good News.

It's Working.

Now i need understand how create others parsers for future.

Tnks so mutch for this support

.

[WilliamMotley1]

Good to hear.  You're very welcome!

If you're looking for a deep dive in writing your own packet parsers: https://community.rsa.com/docs/DOC-41370

[CristianoAlves]

Motley, 

More one fast help.

I need parser this event in Response:

And i create this new .lua, but i don't know this is correct:

local message = nw.createParser("message", "custom for Cristiano Alves")
message:setKeys({
nwlanguagekey.create("infomessage"),
})
function message:streamBegin()
self.streamVars = {}
end
function message:onMessage(token, first, last)
self.streamVars.infomessageBegin = last + 1
end
message:setCallbacks({
[nwevents.OnStreamBegin] = message.streamBegin,
['{"Message":"'] = message.onMessage,
})

[WilliamMotley1]

Your parser isn't actually extracting anything.  Your token is the beginning of the message you want to extract.  From there you need to get a chunk of payload, find the end of the message, extract the message, then finally register it as meta.

local message = nw.createParser("message", "custom for Cristiano Alves")
message:setKeys({
  nwlanguagekey.create("infomessage"),
})
function message:onMessage(token, first, last)
  local payload = nw.getPayload(last + 1, last + 255)
  if payload then
    local messageEnd = payload:find('"}')
    if messageEnd then
      local messageContents = payload:tostring(1, messageEnd - 1)
      if messageContents then
        nw.createMeta(self.keys.infomessage, messageContents)
      end
    end
  end
end
message:setCallbacks({
  ['{"Message":"'] = message.onMessage,
})

[CristianoAlves]

Motley.

It's working too.
I regard very mutch for this help
I so need understand more something about the last +1 and last +255, where you input in this code.
But, i'm has reading the material pdf for understand more about lua parse.

more one time, tnks so much for support.

[WilliamMotley1]

> I so need understand more something about the last +1 and last +255, where you input in this code.

That's in Chapter 6, under "Use Small Payload Objects".