intelmq.bots.parsers.key_value package

Submodules

intelmq.bots.parsers.key_value.parser module

Parse a string of key=value pairs.

SPDX-FileCopyrightText: 2020 Linköping University <https://liu.se/> SPDX-License-Identifier: AGPL-3.0-or-later

Tokens which do not contain the kv_separator string are ignored.

Values cannot contain newlines.

param pair_separator

string, default ‘ ‘, string separating key=value pairs

param kv_separator

string, default ‘=’, string separating key and value

param keys

array of strings to strings, names of keys -> names of fields to propagate

param strip_quotes

boolean, default true, remove opening and closing double quotes. Note that quotes do not protect pair separation, so e.g. key=”long value” will still be split into ‘key: “long’ and ‘value”’.

param timestamp_key

string, optional, key containing event timestamp. Numerical values are interpreted as UNIX seconds, others are parsed by dateutil.parser.parse(fuzzy=True). If parsing fails no timestamp field will be added.

intelmq.bots.parsers.key_value.parser.BOT

alias of intelmq.bots.parsers.key_value.parser.KeyValueParserBot

class intelmq.bots.parsers.key_value.parser.KeyValueParserBot(bot_id: str, start: bool = False, sighup_event=None, disable_multithreading: Optional[bool] = None)

Bases: intelmq.lib.bot.ParserBot

Parse key=value strings

init()
keys = {}
kv_separator = '='
pair_separator = ' '
parse_line(row, report)

A generator which can yield one or more messages contained in line.

Report has the full message, thus you can access some metadata. Override for your use.

strip_quotes = True
timestamp_key = None

Module contents