Field splitter (to be deprecated)

This section will soon be removed. To achieve the same results, you can now use the cut middleware. Read the documentation on Parameters to learn how to use and configure it.

The user-fields headers can extract user data from a specified log field and explode it in other fields, thanks to regular expressions.

They can be specified with numbered header blocks (in blue the editable zones) like follows :

  • User-field0-src: SourceFieldName
  • User-field0-sep: Separator
  • User-field0-dest-TargetFieldName1: RegExp1
  • User-field0-dest-TargetFieldName2: RegExp2
  • User-field0-residual: ResidualFieldName

Parameters (headers)

  • User-field0-src: name of the field that will be used to extract user information (the field must be present in the logs) .
  • User-field0-sep: separator character found in the user information source field (we will use the the space word if a space is used as separator)
  • User-field0-dest-TargetFieldName1: target field definition containing the name of the field after the User-field0-dest- string and the regexp corresponding to the data.
    There can be more than one field name (each with its corresponding header). The regular expressions are evaluated in the order of declaration. The separator is used in the output if the field contains many values.
    The strings that don’t match are sent to the User-field0-residual if it’s specified.
  • **User-field0-residual: ** Optional. Target field name used to receive the user information that was not recognized by the regexps used for the previous target fields.

Example:

curl -v -X POST --proxy "" --no-buffer \
  -F "file=@test/dataset/user-mono-plus.log" \
  -H 'Log-Format-ezproxy: %h - %u %t "%r" %s %b %{user}<[a-zA-Z0-9+]*>' \
  -H 'User-field0-src: user'\
  -H 'User-field0-sep: +'\
  -H 'User-field0-dest-groupe: etu|persecr|uncas|unautre'\
  -H 'User-field0-dest-categorie: [0-9]{3}'\
    http://127.0.0.1:59599