Skip to main content
Create a extraction rule.

Usage

Options

  • name
    • Type: STRING
    • Default: “
    • Usage: --name <extraction-name>
    The name of the extraction.
  • description
    • Type: STRING
    • Default: “
    • Usage: --description <extraction-description>
    The description of the extraction.
  • priority
    • Type: INTEGER RANGE
    • Default: 0
    • Usage: --priority <priority>
    The priority of the extraction, higher priority means this rule will execute first. 0<=x<=100.
  • pre
    • Type: BOOL
    • Default: false
    • Usage: --pre <pre>
    Whether this rule should be applied before or after the alert is standardized
  • attribute
    • Type: STRING
    • Default: “
    • Usage: --attribute <extraction-attribute>
    Event attribute name to extract from.
  • regex
    • Type: STRING
    • Default: “
    • Usage: --attribute <regex-regex>
    The regex rule to extract by. Regex format should be like python regex pattern for group matching.
  • condition
    • Type: STRING
    • Default: “
    • Usage: --condition <condition-attribute>
    CEL based condition.
  • help:
    • Type: BOOL
    • Default: false
    • Usage: --help
    Show this message and exit.

CLI Help