intelmq.bots.parsers.key_value package — intelmq 2.3.3.alpha1 documentation

# intelmq.bots.parsers.key_value package

## Submodules

## intelmq.bots.parsers.key_value.parser module

Parse a string of key=value pairs.

SPDX-FileCopyrightText: 2020 Linköping University <https://liu.se/> SPDX-License-Identifier: AGPL-3.0-or-later

Tokens which do not contain the kv_separator string are ignored.

Values cannot contain newlines.

param pair_separator

  string, default ‘ ‘, string separating key=value pairs

param kv_separator

  string, default ‘=’, string separating key and value

param keys

  array of strings to strings, names of keys -> names of fields to propagate

param strip_quotes

  boolean, default true, remove opening and closing double quotes. Note that quotes do not protect pair separation, so e.g. key=”long value” will still be split into ‘key: “long’ and ‘value”’.

param timestamp_key

  string, optional, key containing event timestamp. Numerical values are interpreted as UNIX seconds, others are parsed by dateutil.parser.parse(fuzzy=True). If parsing fails no timestamp field will be added.

`intelmq.bots.parsers.key_value.parser.` `BOT`

  alias of `intelmq.bots.parsers.key_value.parser.KeyValueParserBot`

class `intelmq.bots.parsers.key_value.parser.` `KeyValueParserBot`(bot_id: str, start: bool = False, sighup_event=None, disable_multithreading: Optional[bool] = None)

  Bases: `intelmq.lib.bot.ParserBot`

  `init`()
  `parse_line`(row, report)

    A generator which can yield one or more messages contained in line.

    Report has the full message, thus you can access some metadata. Override for your use.

## Module contents