intelmq.bots.parsers.key_value package¶
Submodules¶
intelmq.bots.parsers.key_value.parser module¶
Parse a string of key=value pairs.
SPDX-FileCopyrightText: 2020 Linköping University <https://liu.se/> SPDX-License-Identifier: AGPL-3.0-or-later
Tokens which do not contain the kv_separator string are ignored.
Values cannot contain newlines.
| param pair_separator: | |
|---|---|
| string, default ‘ ‘, string separating key=value pairs | |
| param kv_separator: | |
| string, default ‘=’, string separating key and value | |
| param keys: | array of strings to strings, names of keys -> names of fields to propagate |
| param strip_quotes: | |
| boolean, default true, remove opening and closing double quotes. Note that quotes do not protect pair separation, so e.g. key=”long value” will still be split into ‘key: “long’ and ‘value”’. | |
| param timestamp_key: | |
| string, optional, key containing event timestamp. Numerical values are interpreted as UNIX seconds, others are parsed by dateutil.parser.parse(fuzzy=True). If parsing fails no timestamp field will be added. | |
-
intelmq.bots.parsers.key_value.parser.BOT¶ alias of
intelmq.bots.parsers.key_value.parser.KeyValueParserBot
-
class
intelmq.bots.parsers.key_value.parser.KeyValueParserBot(bot_id: str, start: bool = False, sighup_event=None, disable_multithreading: bool = None)¶ Bases:
intelmq.lib.bot.ParserBot-
init()¶
-
parse_line(row, report)¶ A generator which can yield one or more messages contained in line.
Report has the full message, thus you can access some metadata. Override for your use.
-
