检索类:
- 比较运算符: ==(eq), !=(ne), >(gt), <(lt), >=(ge), <=(le)
1 | mysql.packet_number == 0 |
- 逻辑运算符: and, or, not
1 | tcp.port ==80 and ip.src == 127.0.0.1 |
- 切片运算符[x:m], [x-m]
1 | http.content_type[0:4] == "text" |
- 搜索/匹配运算符 (contains), matches(~)
1 | http contains "http://www.baidu.com" |
- 转换函数 upper() , lower(), len(), count(), string()
1 | upper(http.request.method) == "POST" |