base/utils/patterns.zeek¶
-
GLOBAL
¶
Functions for creating and working with patterns.
Namespace: | GLOBAL |
---|
Summary¶
Types¶
PatternMatchResult : record |
Functions¶
match_pattern : function |
Matches the given pattern against the given string, returning
a PatternMatchResult record. |
set_to_regex : function |
Given a pattern as a string with two tildes (~~) contained in it, it will return a pattern with string set’s elements OR’d together where the double-tilde was given (this function only works at or before init time). |
Detailed Interface¶
Types¶
Functions¶
-
match_pattern
¶ Type: function
(s:string
, p:pattern
) :PatternMatchResult
Matches the given pattern against the given string, returning a
PatternMatchResult
record. For example:match_pattern("foobar", /o*[a-k]/)
returns[matched=T, str=f, off=1]
, because the first match is for zero o’s followed by an [a-k], butmatch_pattern("foobar", /o+[a-k]/)
returns[matched=T, str=oob, off=2]
.S: a string to match against. P: a pattern to match. Returns: a record indicating the match status.
-
set_to_regex
¶ Type: function
(ss:set
[string
], pat:string
) :pattern
Given a pattern as a string with two tildes (~~) contained in it, it will return a pattern with string set’s elements OR’d together where the double-tilde was given (this function only works at or before init time).
Ss: a set of strings to OR together. Pat: the pattern containing a “~~” in it. If a literal backslash is included, it needs to be escaped with another backslash due to Zeek’s string parsing reducing it to a single backslash upon rendering. Returns: the input pattern with “~~” replaced by OR’d elements of input set.