Skip to content

Commit d5b3a29

Browse files
authored
Merge pull request #1677 from fluent/lynettemiles/sc-136144/update-fluent-bit-docs-pipeline-filters-checklist
2 parents e766cdc + 6223d8e commit d5b3a29

File tree

1 file changed

+16
-22
lines changed

1 file changed

+16
-22
lines changed

pipeline/filters/checklist.md

Lines changed: 16 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1,28 +1,23 @@
1-
---
2-
description: >-
3-
The following plugin looks up if a value in a specified list exists and then
4-
allows the addition of a record to indicate if found. Introduced in version
5-
1.8.4
6-
---
7-
81
# CheckList
92

10-
## Configuration Parameters
3+
The CheckList plugin (introduced in version 1.8.4) looks up a value in a specified list to see if it exists. The plugin then allows the addition of a record to indicate if the value was found.
4+
5+
## Configuration parameters
116

127
The plugin supports the following configuration parameters
138

14-
| Key | Description |
15-
| :--- | :--- |
16-
| file | The single value file that Fluent Bit will use as a lookup table to determine if the specified `lookup_key` exists |
17-
| lookup\_key | The specific key to look up and determine if it exists, supports record accessor |
18-
| record | The record to add if the `lookup_key` is found in the specified `file`. Note you may add multiple record parameters. |
19-
| mode | Set the check mode. `exact` and `partial` are supported. Default : `exact`.|
20-
| print_query_time | Print to stdout the elapseed query time for every matched record. Default: false|
21-
| ignore_case | Compare strings by ignoring case. Default: false |
9+
| Key | Description | Default |
10+
| :-- | :---------- | :------ |
11+
| `file` | The single value file that Fluent Bit will use as a lookup table to determine if the specified `lookup_key` exists. | _none_ |
12+
| `lookup_key` | The specific key to look up and determine if it exists. Supports [record accessor](../../administration/configuring-fluent-bit/classic-mode/record-accessor). | _none_ |
13+
| `record` | The record to add if the `lookup_key` is found in the specified `file`. You can add multiple record parameters. | _none_ |
14+
| `mode` | Set the check mode. `exact` and `partial` are supported. | `exact`|
15+
| `print_query_time` | Print to stdout the elapsed query time for every matched record. | `false` |
16+
| `ignore_case` | Compare strings by ignoring case. | `false` |
2217

23-
## Example Configuration
18+
## Example configuration
2419

25-
```text
20+
```python
2621
[INPUT]
2722
name tail
2823
tag test1
@@ -44,7 +39,7 @@ The plugin supports the following configuration parameters
4439
match test1
4540
```
4641

47-
In the following configuration we will read a file `test1.log` that includes the following values
42+
The following configuration reads a file `test1.log` that includes the following values:
4843

4944
```text
5045
{"remote_addr": true, "ioc":"false", "url":"https://badurl.com/payload.htm","badurl":"no"}
@@ -57,17 +52,16 @@ In the following configuration we will read a file `test1.log` that includes the
5752
5853
```
5954

60-
Additionally, we will use the following lookup file which contains a list of malicious IPs \(`ip_list.txt`\)
55+
Additionally, it uses the following lookup file which contains a list of malicious IP addresses (`ip_list.txt`).
6156

6257
```text
6358
1.2.3.4
6459
6.6.4.232
6560
7.7.7.7
6661
```
6762

68-
In the configuration we are using $remote\_addr as the lookup key and 7.7.7.7 is malicious. This means the record we would output for the last record would look like the following
63+
The configuration uses `$remote_addr` as the lookup key, and `7.7.7.7` is malicious. The record output for the last record would look like the following:
6964

7065
```text
7166
{"remote_addr": "7.7.7.7", "ioc":"abc", "url":"https://badurl.com/payload.htm","badurl":"null"}
7267
```
73-

0 commit comments

Comments
 (0)