utils.zeek¶

Utilities specific for HTTP processing.

Namespace:	HTTP
Imports:	base/protocols/http/main.zeek, base/utils/addrs.zeek

Summary¶

`HTTP::build_url`: `function`	Creates a URL from an `HTTP::Info` record.
`HTTP::build_url_http`: `function`	Creates a URL from an `HTTP::Info` record.
`HTTP::describe`: `function`	Create an extremely shortened representation of a log line.
`HTTP::extract_keys`: `function`	Given a string containing a series of key-value pairs separated by “=”, this function can be used to parse out all of the key names.

HTTP::build_url¶

Type:	`function` (rec: `HTTP::Info`) : `string`

Creates a URL from an HTTP::Info record. This should handle edge cases such as proxied requests appropriately.

Rec:	An `HTTP::Info` record.
Returns:	A URL, not prefixed by `"http://"`.

HTTP::build_url_http¶

Type:	`function` (rec: `HTTP::Info`) : `string`

Creates a URL from an HTTP::Info record. This should handle edge cases such as proxied requests appropriately.

Rec:	An `HTTP::Info` record.
Returns:	A URL prefixed with `"http://"`.

HTTP::describe¶

Type:	`function` (rec: `HTTP::Info`) : `string`

Create an extremely shortened representation of a log line.

HTTP::extract_keys¶

Type:	`function` (data: `string`, kv_splitter: `pattern`) : `string_vec`

Given a string containing a series of key-value pairs separated by “=”, this function can be used to parse out all of the key names.

Data:	The raw data, such as a URL or cookie value.
Kv_splitter:	A regular expression representing the separator between key-value pairs.
Returns:	A vector of strings containing the keys.