...
| Code Block | ||
|---|---|---|
| ||
global {
newline = (13.chr() + "?" + 10.chr()).as("RegExp")
var = function(s) {
p = s.split(re#=#);
{}.put(p[0],p[1])
}
vars = function(s) {
p = s=>s.split(re#&#)|[];
p.reduce(function(a,b){a.put(var(b))},{})
}
parse = function(text,domain) {
dlpo = domain.length() + 1;
text.split(newline)
.filter(function(v){p=v.split(re#/#);p[0]==domain && p.length()==2})
.map(function(v){p=v.split(re#[?]#);[p[0].substr(dlpo),vars(p[1])]})
}
}
rule mail_events {
select when mail events
foreach parse(event:attr("text"),"aurora") setting(request)
pre {
type = request[0];
attrs = request[1];
}
if request.length() == 2 then noop();
fired {
raise aurora event type attributes attrs;
ent:lastRequest := "aurora/"+type;
ent:lastAttrs := attrs;
}
} |
As before, line 2 is a pattern matching line breaks, used to split the entire message body in line 13. The function var (lines 3-6) makes a map for a single attribute ("name=Nemo" becomes {"name": "Nemo"}) and is used in line 9. The function vars (lines 7-10) collects all of the attributes into a single map and is used in line 15. The parse function (lines 11-16) first splits the message body into lines, then (line 14) selects only those lines which start with the domain followed by a slash (the length of that leading substring is maintained in dlpo (domain length plus one)), and finally (line 15) collects for each desired message body line an array whose first entry is the event type, and whose second entry is any collected attributes as a map.
...