Re: Multiline in prelude-lml

Le mercredi 23 juillet 2008 à 15:40 +0200, bob bob a écrit : 
> Ok, maybe an example will help :)
> Here my rules :
> 
> regex=FirstRule; \
>  create_context=FIRST_RULE_MATCHED; \
> silent;
> 
> regex=SecondRule; \
>  require_context=FIRST_RULE_MATCHED; \
> silent;
> 
> regex=ThirdRule; \
>  require_context=FIRST_RULE_MATCHED; \
>  destroy_context=FIRST_RULE_MATCHED; \
> last;
> 
> Then here is my log :
> 
> Log1Line 1
> Log1Line2
> Log1Line3
> 
> Log2Line1
> Log2Line2 ...
> 
> When prelude parse the log, Log1Line1 will match the first rule and
> then, create the context. But, prelude will also try to match second
> and third rule. 

You can avoid it to continue further matching by using the "last"
keyword:

regex=FirstRule; \
create_context=FIRST_RULE_MATCHED; \
silent; last;

> When parsing Log1Line2, this line will match secondRule AND thirdRule.
> So, what I want to do is to stop prelude-lml trying to match thirdRule
> if secondRule has been matched because Log1Line2 will match each,
> second and third rule.

The "last" keyword should be useful here too.

> This is for scholar purpose, I'm trying to parse java stacktrace...

What is the java program producing the stacktrace? 

-- 
Yoann Vandoorselaere | Responsable R&D / CTO | PreludeIDS Technologies
Tel: +33 (0)8 70 70 21 58                  Fax: +33(0)4 78 42 21 58
http://www.prelude-ids.com

_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user