reaction/config/reaction.test.yml

---
patterns:
  ip:
    regex: '(?:(?:[0-9]{1,3}\.){3}[0-9]{1,3})|(?:[0-9a-fA-F:]{2,90})'
    ignore:
      - 1.0.0.1

streams:
  tailDown:
    cmd: [ "sh", "-c", "echo 'found 1.1.1.1' && sleep 2 && echo 'found 1.0.0.1' && sleep 10m" ]
    filters:
      findIP:
        regex:
          - '^found <ip>'
        retry: 2
        retry-period: 1m
        actions:
          damn:
            cmd: [ "echo", "<ip>" ]
          undamn:
            cmd: [ "echo", "undamn", "<ip>" ]
            after: 1m