Parser Field Validations

Inside the global configuration, there is a validation framework that enables you to construct validation rules that cross all sensors. This is done in the form of validation plugins where assertions about fields or whole messages can be made.

The format for this is a fieldValidations field inside of global config. This is associated with an array of field validation objects structured using the following fields:

input

An array of input fields or a single field. If this is omitted, then the whole messages is passed to the validator.

config

A String to Object map for validation configuration. This is optional if the validation function requires no configuration.

validation

The validation function to be used. This is one of the following:

STELLAR: Execute a Stellar Language statement. Expects the query string in the condition field of the config.
IP: Validates that the input fields are an IP address. By default, if no configuration is set, it assumes IPV4, but you can specify the type by passing in type with either IPV6 or IPV4 or by passing in a list [IPV4,IPV6] in which case the input(s) will be validated against both.
DOMAIN: Validates that the fields are all domains.
EMAIL: Validates that the fields are all email addresses.
URL: Validates that the fields are all URLs.
DATE: Validates that the fields are a date. Expects format in the config.
INTEGER: Validates that the fields are an integer. String representation of an integer is allowed.
REGEX_MATCH: Validates that the fields match a regex. Expects pattern in the config.
NOT_EMPTY: Validates that the fields exist and are not empty (after trimming.)

For example, the following validation validates that ip_src_addr is an IPv4 address via the IP validator:

"fieldValidations" : [
              {
                "input" : [ "ip_src_addr" ],
                "validation" : "IP",
                "config" : {
                    "type" : "IPV4"
                           }
              } 
                       ]

You can also create a validation using Stellar. The following validation uses Stellar to validate the same thing as the previous example:

"fieldValidations" : [
              {
                "validation" : "STELLAR",
                "config" : {
                    "condition" : "IS_IP(ip_src_addr, 'IPV4')"
                           }
              } 
                       ]

​Parser Field Validations

Parser Field Validations