intelmq.bots.parsers.key_value package¶
Submodules¶
intelmq.bots.parsers.key_value.parser module¶
Parse a string of key=value pairs.
SPDX-FileCopyrightText: 2020 Linköping University <https://liu.se/> SPDX-License-Identifier: AGPL-3.0-or-later
Tokens which do not contain the kv_separator string are ignored.
Values cannot contain newlines.
- param pair_separator:
string, default ‘ ‘, string separating key=value pairs
- param kv_separator:
string, default ‘=’, string separating key and value
- param keys:
array of strings to strings, names of keys -> names of fields to propagate
- param strip_quotes:
boolean, default true, remove opening and closing double quotes. Note that quotes do not protect pair separation, so e.g. key=”long value” will still be split into ‘key: “long’ and ‘value”’.
- param timestamp_key:
string, optional, key containing event timestamp. Numerical values are interpreted as UNIX seconds, others are parsed by dateutil.parser.parse(fuzzy=True). If parsing fails no timestamp field will be added.
- intelmq.bots.parsers.key_value.parser.BOT¶
alias of
KeyValueParserBot
- class intelmq.bots.parsers.key_value.parser.KeyValueParserBot(*args, **kwargs)¶
Bases:
ParserBotParse key=value strings
- init()¶
- keys = {}¶
- kv_separator = '='¶
- pair_separator = ' '¶
- parse_line(row, report)¶
A generator which can yield one or more messages contained in line.
Report has the full message, thus you can access some metadata. Override for your use.
- strip_quotes = True¶
- timestamp_key = None¶
