Forum Discussion
Chad_Roberts_21
Nimbostratus
NimbostratusStreaming - Logging when content exists
I'm starting to use streaming for the first time, but I'm a little confused by the various commands I've come across in here. I'd like to start with a simple script that logs the uri when certain content exists in the stream.
For example, in my first experiment, I would like to watch for the text "http://" and log the uri. None of the links or references in any of the apps we host should be http, only https, so I would like to log the uri any time this text appears. Can anyone tell me how I might be able to accomplish this?
- I assume you are talking about the stream profile. If so, every time an expression matches, STREAM_MATCHED event is fired. There you can get the matching expression using STREAM::match to see/log what matched. Check out the wiki where I believe all the stream rules are documented.
Chad_Roberts_21That's what I'm talking about... I don't know if you've checked the wiki, but it seems to be extremely lacking when it comes to information and examples about the STREAM commands.
I got something working for what I wanted.when HTTP_REQUEST { set uri [HTTP::uri] } when HTTP_RESPONSE { STREAM::enable STREAM::expression {@http://@} } when STREAM_MATCHED { log "URI $uri contains http reference" }
What I'm trying to do now is find a way to extract not just the exact text matched but enough text afterwards that I might be able to see in the log what link contained the http reference. Is there some way that I might capture the subsequent characters until a certain character is matched (space, quotation mark, whatever), or even grab a set number of characters after (say, the next 30 characters)? I hope that makes sense.- The stream expression string is a regular expression so that should be possible.
