The syntax of the
driplane’s rules is very simple. As for the BASH every filter’s output is sent to the next filter’s input concatenating the two of them with the
All the rules have to start with a name and end with a
Using the directive
import it is possible to include one or more files and their rules in another one. All the rules defined in an included file
are available for the file that imports them.
To use this directive the path of the file can be absolute or relative to the
rules directory specified in the configuration:
Rule Name and Rule Call
Each rule has to start with an identifier follow by
=>. This identifier identifies rule name and it could be used in another rule to concatenate 2 rules together.
IDENTIFIER => ... ;
It can be included in another rule (rule call) prepending the
@ to it.
IDENTIFIER1 => ... ;
IDENTIFIER2 => ... | @IDENTIFIER1 | ... ;
The feeder creates the stream, so they don’t accept inputs. For this reason, they can be positioned ONLY to the beginning of a rule.
The feeder definition starts with a
< char followed by an identifier. That’s the type of the feeder we want to use.
After the type we found a
: char followed by a list of parameters comma separated and a
IDENTIFIER => <FEEDER_TYPE: param1="value1", param2="value2"> | ... ;
The filters are the main operators of a rule, because they decide if a data is interesting and perform operations.
The definition of a filter start with his name and it is followed by parameters contained between
According to the settings a Filter can change his behaviour and can modify the data passing through it.
IDENTIFIER => ... | FILTER_TYPE( param1="value1", ... ) | ... ;
!can be used on filter to negate his result (propagate the data if the condition is not verified).
It has to be put before the filter definition:
JSON requires double quotes to encode strings, so in order to define a JSON string you need to escape the quotes
Data message and Extra
The data stream in
driplane is based on text and the basic object that is part of it is the Message.
The Message is an object that contains the text that needs to be filtered and extra.
The main string is identified as
text in the filters, whereas the extra data are identified by a key.
There are fixed extra, created from
driplane itself and other extras related to a feeder or filter.
|source_feeder||the name of the feeder creates this Message|
|rule_name||the name of the rule that contains this filter|