26 lines
788 B
YAML
26 lines
788 B
YAML
---
|
|
patterns:
|
|
num:
|
|
regex: '[0-9]+'
|
|
ip:
|
|
regex: '(?:(?:[0-9]{1,3}\.){3}[0-9]{1,3})|(?:[0-9a-fA-F:]{2,90})'
|
|
ignore:
|
|
- 1.0.0.1
|
|
|
|
streams:
|
|
tailDown1:
|
|
cmd: [ "sh", "-c", "echo 1 2 3 4 5 1 2 3 4 5 1 2 3 4 1 2 3 4 1 2 3 4 1 2 3 4 1 2 3 4 1 2 3 4 1 2 3 4 1 2 3 4 1 2 3 4 1 2 3 4 1 2 3 4 1 2 3 4 1 2 3 4 1 2 3 4 1 2 3 4 1 2 3 4 1 2 3 4 1 2 3 4 1 2 3 4 1 2 3 4 1 2 3 4 1 2 3 4 1 2 3 4 1 2 3 4 1 2 3 4 | tr ' ' '\n' | while read i; do sleep 2; echo found $(($i % 10)); done" ]
|
|
filters:
|
|
findIP:
|
|
regex:
|
|
- '^found <num>$'
|
|
retry: 3
|
|
retry-period: 30s
|
|
actions:
|
|
damn:
|
|
cmd: [ "echo", "<num>" ]
|
|
undamn:
|
|
cmd: [ "echo", "undamn", "<num>" ]
|
|
after: 30s
|
|
onexit: true
|