Messag...Regexp(3pm)

💖 Messag...Regexp(3pm) 💖

okay bestie, so this is the Message::Passing::Filter::Regexp page — it's part of the User Contributed Perl Documentation, and it's literally the Regexp Capture Filter For Message::Passing. no cap, that's the whole name. let's get into it 🫶

---

✨ SYNOPSIS ✨

# regexfile
[FORMAT]
:default = %date %status %remotehost %domain %request %originhost %responsetime %upstreamtime %bytes %referer %ua %xff
:nginxaccesslog = %date %status %remotehost %bytes %responsetime
[REGEXP]
%date = (?#=date)\[(?#=ts)\d{2}\/\w{3}\/\d{4}(?::\d{2}){3}(?#!ts) [-+]\d{4}\](?#!date)
%status = (?#=status)\d+(?#!status)
%remotehost = (?#=remotehost)\S+(?#!remotehost)
%domain = (?#=domain).*?(?#!domain)
%request = (?#=request)-|(?#=method)\w+(?#!method) (?#=url).*?(?#!url) (?#=version)HTTP/\d\.\d(?#!version)(?#!request)
%originhost = (?#=originhost)-|(?#=oh).*?(?#!oh):\d+(?#!originhost)
%responsetime = (?#=responsetime)-|.*?(?#!responsetime)
%upstreamtime = (?#=upstreamtime).*?(?#!upstreamtime)
%bytes = (?#=bytes)\d+(?#!bytes)
%referer = (?#=referer)\"(?#=ref).*?(?#!ref)\"(?#!referer)
%useragent = (?#=useragent)\"(?#=ua).*?(?#!ua)\"(?#!useragent)
%xforwarderfor = (?#=xforwarderfor)\"(?#=xff).*?(?#!xff)\"(?#!xforwarderfor)

# message-passing-cli
use Message::Passing::DSL;
run_message_server message_chain {
    output stdout => (
        class => 'STDOUT',
    );
    output elasticsearch => (
        class => 'ElasticSearch',
        elasticsearch_servers => ['127.0.0.1:9200'],
    );
    encoder("encoder",
        class => 'JSON',
        output_to => 'stdout',
        output_to => 'es',
    );
    filter regexp => (
        class => 'Regexp',
        format => ':nginxaccesslog',
        capture => [qw( ts status remotehost url oh responsetime upstreamtime bytes )]
        output_to => 'encoder',
    );
    filter logstash => (
        class => 'ToLogstash',
        output_to => 'regexp',
    );
    decoder decoder => (
        class => 'JSON',
        output_to => 'logstash',
    );
    input file => (
        class => 'FileTail',
        output_to => 'decoder',
    );
};

ngl that regexfile is giving ✨immaculate✨ — those (?#=name) and (?#!name) markers are doing SO much work, bestie.

---

🌸 DESCRIPTION 🌸

so this filter literally just passes every incoming message straight through, but it grabs regexp captures along the way. slay. 💅

⚠️ the tea you need to know: it has to be running after Message::Passing::Filter::ToLogstash, because it doesn't process with json format — it goes straight in and captures "$message->{'@message'}" data lines into "%{ $message->{'@fields'} }". periodt, no shortcuts.

---

👑 ATTRIBUTES 👑

🎀 regexfile

Path of your regexfile. Default is /etc/message-passing/regexfile.

🎀 format

Name of a defined format in your regexfile.

🎀 capture

ArrayRef of regex names which you want to capture and has been defined in your regexfile. note delete the prefix "%".

🎀 fromto

HashRef of fields which you want capture from and to. Default as { '@message' => '@fields' }.

If you set undef to one key, such field will exists directly in %$message.

---

🦋 SEE ALSO 🦋

• Idea steal from <http://logstash.net> Grok filter
• Config Format see Config::Tiny

---

🌈 AUTHOR 🌈

chenryn, <rao.chenlin@gmail.com<gt>

---

💜 CONTRIBUTOR 💜

Alexander Hartmaier

---

💖 COPYRIGHT AND LICENSE 💖

Copyright (C) 2012 by chenryn

This library is free software; you can redistribute it and/or modify it under the same terms as Perl itself, either Perl version 5.14.2 or, at your option, any later version of Perl 5 you may have available.

---

and that's the whole page bestie!! 🥳 this little icon shipped as part of perl v5.34.0, dated 2022-06-15 — so it's been out here being iconic for a minute. go forth and capture those fields, mwah 💋🎀✨