update parser and scenari doc (#116)
Co-authored-by: AlteredCoder <AlteredCoder>
This commit is contained in:
parent
eef1847873
commit
672785ba17
|
@ -151,10 +151,14 @@ It is meant to help understanding parser node behaviour by providing contextual
|
||||||
filter: expression
|
filter: expression
|
||||||
```
|
```
|
||||||
|
|
||||||
`filter` must be a valid {{expr.htmlname}} expression that will be evaluated against the {{event.name}}.
|
`filter` must be a valid {{expr.htmlname}} expression that will be evaluated against the {{event.htmlname}}.
|
||||||
|
|
||||||
If `filter` evaluation returns true or is absent, node will be processed.
|
If `filter` evaluation returns true or is absent, node will be processed.
|
||||||
|
|
||||||
If `filter` returns `false` or a non-boolean, node won't be processed.
|
If `filter` returns `false` or a non-boolean, node won't be processed.
|
||||||
|
|
||||||
|
Here is the [expr documentation](https://github.com/antonmedv/expr/tree/master/docs).
|
||||||
|
|
||||||
Examples :
|
Examples :
|
||||||
|
|
||||||
- `filter: "evt.Meta.foo == 'test'"`
|
- `filter: "evt.Meta.foo == 'test'"`
|
||||||
|
|
|
@ -87,12 +87,16 @@ The name must be unique (and will define the scenario's name in the hub), and th
|
||||||
### filter
|
### filter
|
||||||
|
|
||||||
```yaml
|
```yaml
|
||||||
filter: evt.Meta.log_type == 'telnet_new_session'
|
filter: expression
|
||||||
```
|
```
|
||||||
|
|
||||||
|
`filter` must be a valid {{expr.htmlname}} expression that will be evaluated against the {{event.htmlname}}.
|
||||||
|
|
||||||
an {{expr.htmlname}} that must return true if the event is eligible for the bucket.
|
If `filter` evaluation returns true or is absent, event will be pour in the bucket.
|
||||||
|
|
||||||
|
If `filter` returns `false` or a non-boolean, the event will be skip for this bucket.
|
||||||
|
|
||||||
|
Here is the [expr documentation](https://github.com/antonmedv/expr/tree/master/docs).
|
||||||
|
|
||||||
Examples :
|
Examples :
|
||||||
|
|
||||||
|
|
Loading…
Reference in a new issue