pC_f5dcjsonhttpsessionsuccessfailwafaction.md

Parser Content

{
Name = f5-dc-json-http-session-success-fail-wafaction
  ParserVersion = v1.0.0
  Conditions = [ """"policy_hits":""", """"vh_type":""", """"vh_name":""", """"scheme":""", """"waf_action":""" ]

f5-distributed-cloud-json {
    Vendor = F5
    Product = F5 Distributed Cloud
    ExtractionType = json
    TimeFormat = "yyyy-MM-dd'T'HH:mm:ss.SSSZ"
    Fields = [
      """exa_json_path=$.time,exa_field_name=time"""
      """exa_json_path=$.vh_name,exa_field_name=host"""
      """exa_json_path=$.src_ip,exa_regex=({src_ip}((([0-9a-fA-F.]{0,4}):{1,2}){1,7}([0-9a-fA-F]){0,4})|(((25[0-5]|(2[0-4]|1\d|[0-9]|)\d)\.?\b){4}))(:({src_port}\d+))?"""
      """exa_json_path=$.src_port,exa_field_name=src_port"""
      """exa_json_path=$.dst_ip,exa_regex=({dest_ip}((([0-9a-fA-F.]{0,4}):{1,2}){1,7}([0-9a-fA-F]){0,4})|(((25[0-5]|(2[0-4]|1\d|[0-9]|)\d)\.?\b){4}))(:({dest_port}\d+))?"""
      """exa_json_path=$.dst_port,exa_field_name=dest_port"""
      """exa_json_path=$.user_agent,exa_field_name=user_agent"""
      """exa_json_path=$.browser_type,exa_field_name=browser"""
      """exa_json_path=$.method,exa_field_name=method"""
      """exa_json_path=$.rsp_code,exa_field_name=http_response_code"""
      """exa_json_path=$.rsp_code_details,exa_field_name=additional_info"""
      """exa_json_path=$.rsp_headers,exa_field_name=response"""
      """exa_json_path=$.referer,exa_field_name=referrer"""
      """exa_json_path=$.protocol,exa_field_name=protocol"""
      """exa_json_path=$.req_size,exa_field_name=bytes_in"""
      """exa_json_path=$.rsp_size,exa_field_name=bytes_out"""
      """exa_json_path=$.policy,exa_field_name=policy_name"""
      """exa_json_path=$.policy_hits..result,exa_field_name=action"""
      """exa_json_path=$.waf_action,exa_field_name=action"""
      """exa_json_path=$.app,exa_field_name=app"""
      """exa_json_path=$.app_type,exa_field_name=app_type"""
      
}