From b4f9c4090f53a867f5a6eadff495c12f66e4e24c Mon Sep 17 00:00:00 2001 From: Vsevolod Stakhov Date: Fri, 12 Feb 2016 15:42:33 +0000 Subject: [PATCH] Update documentation --- doc/markdown/modules/multimap.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/doc/markdown/modules/multimap.md b/doc/markdown/modules/multimap.md index 2912b923d..5d066d67f 100644 --- a/doc/markdown/modules/multimap.md +++ b/doc/markdown/modules/multimap.md @@ -90,6 +90,9 @@ URL maps allows another set of filters (by default, url maps are matched using h * `tld` - matches TLD (top level domain) part of urls * `full` - matches the complete URL not the hostname * `is_phished` - matches hostname but if and only if the URL is phished (e.g. pretended to be from another domain) +* `regexp:/re/` - extracts generic information using the specified regular expression from the hostname +* `tld:regexp:/re/` - extracts generic information using the specified regular expression from the TLD part +* `full:regexp:/re/` - extracts generic information using the specified regular expression from the full URL text Here are some examples of pre-filter configurations: @@ -114,4 +117,10 @@ url_map { map = "file:///tmp/url.map"; symbol = "URL_MAP"; } +url_tld_re { + type = "url"; + filter = "tld:regexp:/\.[^.]+$/"; # Extracts the last component of URL + map = "file:///tmp/url.map"; + symbol = "URL_MAP_RE"; +} ~~~ \ No newline at end of file -- 2.39.5