Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: allow for TLS

...

Code Block
event:attr("url").extract(re#httpre#https?://([^/:]+)#)

Note that the syntax above has been deprecated in favor of

Code Block
event:attrs{"url"}.extract(re#httpre#https?://([^/:]+)#)

Other alternatives

...

Code Block
event:attrs.get("url").extract(re#httpre#https?://([^/:]+)#)

That works because event:attrs evaluates to a KRL map, so that any of Map Operators and expressions can be used with it. As an additional example, if we just wanted to see if the attributes included an attribute named “url” we could use:

...

Finally, as one of the matches in a select when we could use (see Event Expressions in the Grammar page):

Code Block
url re#httpre#https?://([^/:]+)# setting(domain)

...