PPA Tools PPA Tools: Text

Summary

This module contains actions used to process & search text.

Actions

ppa_tools.text.

extract_values

Find & extract one or more named values from some text using regular expressions.

This action supports both single & multiple lines of text.

Minimum Plugin Version: 1.3.0

Regular Expressions

The following regex cheat-sheet & visualiser can help you get started with expressions.

Input

  • values: a single or list of NamedGroup dictionaries

  • text: the text to find & extract values from

Output

A list of dictionaries containing any matches found in the text.

Each dictionary's key is the name of the NamedGroup, & its value is the matching text.

Example

Finding all usernames from a failed SSH logon message & saving the matches as usernames.

1
2
3
4
5
6
7
8
- ppa_tools.text.extract_values:
    values:
      name: username
      expression: password for (.*) from
    text: >
      2020-08-11T08:19:40.463248+00:00 machine-name sshd[10349]: Failed password for user_1 from 1.2.3.4 port 58041 ssh2
      2020-08-12T13:24:07.463248+00:00 machine-name sshd[10349]: Failed password for user_2 from 2.3.4.5 port 58041 ssh2
  save: usernames

The contents of the new usernames variable will be:

1
2
- username: user_1
  username: user_2

ppa_tools.text.

split_lines

Split a string into a list of strings based on new lines.

Minimum Plugin Version: 3.3.0

Input
  • text: the string to split
Output

A list of strings.

Example

Splitting on one or more new line characters:

- ppa_tools.text.split_lines:
    text: >
      Line one
      Line two
      Line three
save: split_output

The output will be:

- Line one
- Line two
- Line three