Name Value Pair matcher (namevaluepair-matcher)

field (Required)

The field to which you want the pattern to apply; for example, EventName or SourceIp. You can use any of the field names that are listed in the Table 2.

pattern-id (Required)

The pattern that you want to use when the field is parsed from the payload. This value must match (including case) the ID parameter of an already defined pattern. (Table 1)

order (Required)

The order that you want this pattern to attempt among matchers that are assigned to the same field. If two matchers are assigned to the EventName field, the one with the lowest order is attempted first.

The regular regex, JSON, LEEF, and CEF matchers are combined into one list. The different types of matchers are attempted based on their orders, and the process stops when one of the matchers is able to parse out data from the payload.

enable-substitutions (Optional)

Boolean

When set to true, a field cannot be adequately represented with a straight group capture. You can combine multiple groups with extra text to form a value.

Default is false.

ext-data (Optional)

An extra-data parameter that defines any extra field information or formatting that a matcher field can provide in the extension.

The only field that currently uses this parameter is DeviceTime.

For example, you might have a device that sends events by using a unique time stamp, but you want the event to be reformatted to a standard device time. Use the ext-data parameter included with the DeviceTime field to reformat the date and time stamp of the event. For more information, see the Table 2.

delimiter-pair (Optional)

delimiter-namevalue (Optional)