intelmq.bots.parsers.key_value package

Submodules

intelmq.bots.parsers.key_value.parser module

Parse a string of key=value pairs.

SPDX-FileCopyrightText: 2020 Linköping University <https://liu.se/> SPDX-License-Identifier: AGPL-3.0-or-later

Tokens which do not contain the kv_separator string are ignored.

Values cannot contain newlines.

param pair_separator:
 string, default ‘ ‘, string separating key=value pairs
param kv_separator:
 string, default ‘=’, string separating key and value
param keys:array of strings to strings, names of keys -> names of fields to propagate
param strip_quotes:
 boolean, default true, remove opening and closing double quotes. Note that quotes do not protect pair separation, so e.g. key=”long value” will still be split into ‘key: “long’ and ‘value”’.
param timestamp_key:
 string, optional, key containing event timestamp. Numerical values are interpreted as UNIX seconds, others are parsed by dateutil.parser.parse(fuzzy=True). If parsing fails no timestamp field will be added.
intelmq.bots.parsers.key_value.parser.BOT

alias of intelmq.bots.parsers.key_value.parser.KeyValueParserBot

class intelmq.bots.parsers.key_value.parser.KeyValueParserBot(bot_id: str, start: bool = False, sighup_event=None, disable_multithreading: bool = None)

Bases: intelmq.lib.bot.ParserBot

init()
parse_line(row, report)

A generator which can yield one or more messages contained in line.

Report has the full message, thus you can access some metadata. Override for your use.

Module contents