Regex assign

This block is used to automatically replace regular expression by selected option. Block simplifies creating regex rules by substituting such regex by defined name. Substituted regex also contains data type specification so you don’t have to retype parsed values afterwards.

For example if you want to parse IP address, this block can be inserted into place instead of defining whole IP regex. Value will be parsed into specified key.

Block creates also automatic value typing for parsed values.

Block provides the choice from a set of basic regex definitions with associated data types:

• int: numeric type,
• float: number with decimal point,
• string: text data type,
• ip: IP address data type,
• mac: MAC address data type,
• vlan: VLAN data type.

Custom replacing of regular expressions can be defined. See more in the “Substitutions” chapter.

XML representation of regex_assign block

<xml xmlns="http://www.w3.org/1999/xhtml">
  <block type="regex_assign">
    <field name="TYPE">int</field>
    <field name="VAR">key_name</field>
  </block>
</xml>

Block is used on the “by regex” row in the example:

• Expression “string_nospace as Login”: creates Login variable, value will be only text without spaces.
• Expression “ip as src_ip”: creates variable src_ip with value “192.168.10.1”.
• Expression “int as port”: variable “port” is created with value “1234”.
• Expression “ip as dst_ip”:creates “dst_ip” variable with value “192.168.1.1”.
• Expression “string_nospace as protocol”: creates “protocol” variable with value “https”.
• Expression “string as username”: creates “username” variable with value “admin”.

Login permitted from 192.168.10.1/1234 to inside:192.168.1.1/https for user admin