object IPFIXFieldParsing extends RegexParsers
Parser for IPFIX field expressions.
Note that whitespace is allowed anywhere and not significant except between quotes.
fieldUnion ::=
| field "|" fieldUnion
| field
fieldUnion is the top-level entrypoint. A fieldUnion is a set of one or more fields separated by pipes, allowing for the first match. fieldUnions can appear inside parentheses in sub-expressions.
field ::= | "(" fieldUnion ")" | "array" "(" fieldUnion ")" | "match" "(" fieldUnion "," id "," fieldUnion ")" | "struct" "(" namedFieldList ")" | "**" "/" field | wildId ":" wildId "/" field | wildId "/" field | wildId "[" elemId "]" | funcId | elemId
field is the place most stuff happens. Here are all of the different sorts of fields:
Fields may be grouped by parentheses like (<field> [ | <field> ... ])
,
and field unions may appear inside the parenthesis.
To collect all values from the given field into an array,
array(<fieldUnion>)
may be used.
match(<fieldUnion>, <value>, <fieldUnion>)
takes the results of two
field expressions in parallel. The first field is the "key field", the
value is the "target value", and the second field is the "value field".
If the key field's iterator's value ki
in a given position i
matches
the target value, then the result field's iterators value vi
at that
same location is included in the result of the match. (The value is
parsed in the same way as an ID, and is taken as a literal value, a
string or integral value depending on the type of the matched field.)
To produce a structured value, struct(<namedField>[, <namedField>
...])
takes multiple field expressions in parallel to produce a
possibly nested record structure. All of the sub-fields' iterators are
zipped together to produce an iterator of records.
**/<field>
may be used to apply the given field in this record or
a subrecord at any depth. This is useful for cases where you don't know
where an Information Element might appear in a record.
To access nested SubTemplateList or SubTemplateMultiList data,
<listElemName> [: <templateName>] / <field>
will find the given field
in a subrecord in the given STL- or STML-typed information element, and
optionally under a template that has been given the provided name.
Either templateElemName or templateName can be *
for a wildcard.
func:<funcName>
will use the registered function field with this name
on the current record and produce the result.
Finally, the most basic <elemName>
will find the named information
element in the current record.
namedFieldList ::=
| namedField "," namedFieldList
| namedField
A namedFieldList is a comma-separated list of named fields, as arguments to struct or match.
namedField ::=
| id "=" fieldUnion
| fieldUnion
A namedField gives a field a name--for example, in the fields of a
struct(<namedField>[, <namedField ...])
call, to give names ot the
nested structure. If a name isn't given for the field, one will be
generated from the field expression in a unspecified manner.
id ::= | [not whitespace or any of '/:()\"']+ | '"' ([not '\' or '"']+ | "\" [any of 'btnfr\"''])* '"'
An ID can't have a number of special symbols in it, but you can put an escaped ID in quotes that can have anything at all.
wildId ::= id | '*'
Wildcard IDs (for subrecord IE names and subtemplate names) can be an ID or * for "any".
funcId ::= "func:" id
Calls to function fields are identified with "func:<id>". See the func package for details on what function fields are defined.
elemId ::= id - "array"
Individual element fields can can be any ID other than "array" (unless it's in quotes).
- Alphabetic
- By Inheritance
- IPFIXFieldParsing
- RegexParsers
- Parsers
- AnyRef
- Any
- Hide All
- Show All
- Public
- Protected
Type Members
- type Elem = Char
- Definition Classes
- RegexParsers → Parsers
- case class Error extends NoSuccess with Product with Serializable
- Definition Classes
- Parsers
- case class Failure extends NoSuccess with Product with Serializable
- Definition Classes
- Parsers
- type Input = Reader[Elem]
- Definition Classes
- Parsers
- sealed abstract class NoSuccess extends ParseResult[Nothing]
- Definition Classes
- Parsers
- trait OnceParser[+T] extends Parser[T]
- Definition Classes
- Parsers
- sealed abstract class ParseResult[+T] extends AnyRef
- Definition Classes
- Parsers
- abstract class Parser[+T] extends (Input) => ParseResult[T]
- Definition Classes
- Parsers
- case class Success[+T] extends ParseResult[T] with Product with Serializable
- Definition Classes
- Parsers
- case class ~[+a, +b] extends Product with Serializable
- Definition Classes
- Parsers
Value Members
- final def !=(arg0: Any): Boolean
- Definition Classes
- AnyRef → Any
- final def ##: Int
- Definition Classes
- AnyRef → Any
- final def ==(arg0: Any): Boolean
- Definition Classes
- AnyRef → Any
- def OnceParser[T](f: (Input) => ParseResult[T]): Parser[T] with OnceParser[T]
- Definition Classes
- Parsers
- def Parser[T](f: (Input) => ParseResult[T]): Parser[T]
- Definition Classes
- Parsers
- def accept[U](expected: String, f: PartialFunction[Elem, U]): Parser[U]
- Definition Classes
- Parsers
- def accept[ES](es: ES)(implicit f: (ES) => List[Elem]): Parser[List[Elem]]
- Definition Classes
- Parsers
- implicit def accept(e: Elem): Parser[Elem]
- Definition Classes
- Parsers
- def acceptIf(p: (Elem) => Boolean)(err: (Elem) => String): Parser[Elem]
- Definition Classes
- Parsers
- def acceptMatch[U](expected: String, f: PartialFunction[Elem, U]): Parser[U]
- Definition Classes
- Parsers
- def acceptSeq[ES](es: ES)(implicit f: (ES) => Iterable[Elem]): Parser[List[Elem]]
- Definition Classes
- Parsers
- def apply[T](input: String): IPFIXField[T]
- def arrayField: Parser[IPFIXField[Any]]
- final def asInstanceOf[T0]: T0
- Definition Classes
- Any
- def atomId: Parser[String]
- def basicListField: Parser[IPFIXField[Any]]
- def chainl1[T, U](first: => Parser[T], p: => Parser[U], q: => Parser[(T, U) => T]): Parser[T]
- Definition Classes
- Parsers
- def chainl1[T](p: => Parser[T], q: => Parser[(T, T) => T]): Parser[T]
- Definition Classes
- Parsers
- def chainr1[T, U](p: => Parser[T], q: => Parser[(T, U) => U], combine: (T, U) => U, first: U): Parser[U]
- Definition Classes
- Parsers
- def clone(): AnyRef
- Attributes
- protected[lang]
- Definition Classes
- AnyRef
- Annotations
- @throws(classOf[java.lang.CloneNotSupportedException]) @native()
- def commit[T](p: => Parser[T]): Parser[T]
- Definition Classes
- Parsers
- def deepTemplateField: Parser[IPFIXField[Any]]
- def elem(e: Elem): Parser[Elem]
- Definition Classes
- Parsers
- def elem(kind: String, p: (Elem) => Boolean): Parser[Elem]
- Definition Classes
- Parsers
- def elemField: Parser[IPFIXField[Any]]
- def elemId: Parser[String]
- final def eq(arg0: AnyRef): Boolean
- Definition Classes
- AnyRef
- def equals(arg0: AnyRef): Boolean
- Definition Classes
- AnyRef → Any
- def err(msg: String): Parser[Nothing]
- Definition Classes
- Parsers
- def failure(msg: String): Parser[Nothing]
- Definition Classes
- Parsers
- def field: Parser[IPFIXField[Any]]
- def fieldUnion: Parser[IPFIXField[Any]]
- def finalize(): Unit
- Attributes
- protected[lang]
- Definition Classes
- AnyRef
- Annotations
- @throws(classOf[java.lang.Throwable])
- def funcField: Parser[IPFIXField[Any]]
- def funcId: Parser[String]
- final def getClass(): Class[_ <: AnyRef]
- Definition Classes
- AnyRef → Any
- Annotations
- @native()
- def guard[T](p: => Parser[T]): Parser[T]
- Definition Classes
- Parsers
- def handleWhiteSpace(source: CharSequence, offset: Int): Int
- Attributes
- protected
- Definition Classes
- RegexParsers
- def hashCode(): Int
- Definition Classes
- AnyRef → Any
- Annotations
- @native()
- def id: Parser[String]
- final def isInstanceOf[T0]: Boolean
- Definition Classes
- Any
- implicit def literal(s: String): Parser[String]
- Definition Classes
- RegexParsers
- def log[T](p: => Parser[T])(name: String): Parser[T]
- Definition Classes
- Parsers
- def lookupFunc(name: String): IPFIXField[Any]
- def matchField: Parser[IPFIXField[Any]]
- def mkList[T]: (~[T, List[T]]) => List[T]
- Definition Classes
- Parsers
- def namedField: Parser[(String, IPFIXField[Any])]
- def namedFieldList: Parser[Seq[(String, IPFIXField[Any])]]
- final def ne(arg0: AnyRef): Boolean
- Definition Classes
- AnyRef
- def not[T](p: => Parser[T]): Parser[Unit]
- Definition Classes
- Parsers
- final def notify(): Unit
- Definition Classes
- AnyRef
- Annotations
- @native()
- final def notifyAll(): Unit
- Definition Classes
- AnyRef
- Annotations
- @native()
- def opt[T](p: => Parser[T]): Parser[Option[T]]
- Definition Classes
- Parsers
- def parse[T](p: Parser[T], in: Reader): ParseResult[T]
- Definition Classes
- RegexParsers
- def parse[T](p: Parser[T], in: CharSequence): ParseResult[T]
- Definition Classes
- RegexParsers
- def parse[T](p: Parser[T], in: Reader[Char]): ParseResult[T]
- Definition Classes
- RegexParsers
- def parseAll[T](p: Parser[T], in: CharSequence): ParseResult[T]
- Definition Classes
- RegexParsers
- def parseAll[T](p: Parser[T], in: Reader): ParseResult[T]
- Definition Classes
- RegexParsers
- def parseAll[T](p: Parser[T], in: Reader[Char]): ParseResult[T]
- Definition Classes
- RegexParsers
- def phrase[T](p: Parser[T]): Parser[T]
- Definition Classes
- RegexParsers → Parsers
- def positioned[T <: Positional](p: => Parser[T]): Parser[T]
- Definition Classes
- RegexParsers → Parsers
- def quotedId: Parser[String]
- implicit def regex(r: Regex): Parser[String]
- Definition Classes
- RegexParsers
- def rep[T](p: => Parser[T]): Parser[List[T]]
- Definition Classes
- Parsers
- def rep1[T](first: => Parser[T], p0: => Parser[T]): Parser[List[T]]
- Definition Classes
- Parsers
- Annotations
- @migration
- Migration
(Changed in version 2.9.0) The
p0
call-by-name arguments is evaluated at most once per constructed Parser object, instead of on every need that arises during parsing.
- def rep1[T](p: => Parser[T]): Parser[List[T]]
- Definition Classes
- Parsers
- def rep1sep[T](p: => Parser[T], q: => Parser[Any]): Parser[List[T]]
- Definition Classes
- Parsers
- def repN[T](num: Int, p: => Parser[T]): Parser[List[T]]
- Definition Classes
- Parsers
- def repsep[T](p: => Parser[T], q: => Parser[Any]): Parser[List[T]]
- Definition Classes
- Parsers
- def skipWhitespace: Boolean
- Definition Classes
- RegexParsers
- def structField: Parser[IPFIXField[Any]]
- def subTemplateField: Parser[IPFIXField[Any]]
- def success[T](v: T): Parser[T]
- Definition Classes
- Parsers
- final def synchronized[T0](arg0: => T0): T0
- Definition Classes
- AnyRef
- def toString(): String
- Definition Classes
- AnyRef → Any
- final def wait(): Unit
- Definition Classes
- AnyRef
- Annotations
- @throws(classOf[java.lang.InterruptedException])
- final def wait(arg0: Long, arg1: Int): Unit
- Definition Classes
- AnyRef
- Annotations
- @throws(classOf[java.lang.InterruptedException])
- final def wait(arg0: Long): Unit
- Definition Classes
- AnyRef
- Annotations
- @throws(classOf[java.lang.InterruptedException]) @native()
- val whiteSpace: Regex
- Attributes
- protected
- Definition Classes
- RegexParsers
- def wild(p: Parser[String]): Parser[Option[String]]
This is documentation for Mothra, a collection of Scala and Spark library functions for working with Internet-related data. Some modules contain APIs of general use to Scala programmers. Some modules make those tools more useful on Spark data-processing systems.
Please see the documentation for the individual packages for more details on their use.
Scala Packages
These packages are useful in Scala code without involving Spark:
org.cert.netsa.data
This package, which is collected as the
netsa-data
library, provides types for working with various kinds of information:org.cert.netsa.data.net
- types for working with network dataorg.cert.netsa.data.time
- types for working with time dataorg.cert.netsa.data.unsigned
- types for working with unsigned integral valuesorg.cert.netsa.io.ipfix
The
netsa-io-ipfix
library provides tools for reading and writing IETF IPFIX data from various connections and files.org.cert.netsa.io.silk
To read and write CERT NetSA SiLK file formats and configuration files, use the
netsa-io-silk
library.org.cert.netsa.util
The "junk drawer" of
netsa-util
so far provides only two features: First, a method for equipping Scala scala.collection.Iterators with exception handling. And second, a way to query the versions of NetSA libraries present in a JVM at runtime.Spark Packages
These packages require the use of Apache Spark:
org.cert.netsa.mothra.datasources
Spark datasources for CERT file types. This package contains utility features which add methods to Apache Spark DataFrameReader objects, allowing IPFIX and SiLK flows to be opened using simple
spark.read...
calls.The
mothra-datasources
library contains both IPFIX and SiLK functionality, whilemothra-datasources-ipfix
andmothra-datasources-silk
contain only what's needed for the named datasource.org.cert.netsa.mothra.analysis
A grab-bag of analysis helper functions and example analyses.
org.cert.netsa.mothra.functions
This single Scala object provides Spark SQL functions for working with network data. It is the entirety of the
mothra-functions
library.