}
]
-# meta time "1970-05-23 21:07:14" drop
-[
- {
- "match": {
- "left": {
- "meta": {
- "key": "time"
- }
- },
- "op": "==",
- "right": "1970-05-23 21:07:14"
- }
- },
- {
- "drop": null
- }
-]
-
# meta time 12341234 drop
[
{
}
]
-# meta time "2019-06-21 17:00:00" drop
-[
- {
- "match": {
- "left": {
- "meta": {
- "key": "time"
- }
- },
- "op": "==",
- "right": "2019-06-21 17:00:00"
- }
- },
- {
- "drop": null
- }
-]
-
-# meta time "2019-07-01 00:00:00" drop
-[
- {
- "match": {
- "left": {
- "meta": {
- "key": "time"
- }
- },
- "op": "==",
- "right": "2019-07-01 00:00:00"
- }
- },
- {
- "drop": null
- }
-]
-
-# meta time "2019-07-01 00:01:00" drop
-[
- {
- "match": {
- "left": {
- "meta": {
- "key": "time"
- }
- },
- "op": "==",
- "right": "2019-07-01 00:01:00"
- }
- },
- {
- "drop": null
- }
-]
-
-# meta time "2019-07-01 00:00:01" drop
-[
- {
- "match": {
- "left": {
- "meta": {
- "key": "time"
- }
- },
- "op": "==",
- "right": "2019-07-01 00:00:01"
- }
- },
- {
- "drop": null
- }
-]
-
-# meta day "Saturday" drop
-[
- {
- "match": {
- "left": {
- "meta": {
- "key": "day"
- }
- },
- "op": "==",
- "right": "Saturday"
- }
- },
- {
- "drop": null
- }
-]
-
# meta day 6 drop
[
{
}
]
-# meta hour "17:00" drop
-[
- {
- "match": {
- "left": {
- "meta": {
- "key": "hour"
- }
- },
- "op": "==",
- "right": "17:00"
- }
- },
- {
- "drop": null
- }
-]
-
# meta hour "17:00:00" drop
[
{
}
]
-# meta hour "17:00:01" drop
-[
- {
- "match": {
- "left": {
- "meta": {
- "key": "hour"
- }
- },
- "op": "==",
- "right": "17:00:01"
- }
- },
- {
- "drop": null
- }
-]
-
-# meta hour "00:00" drop
-[
- {
- "match": {
- "left": {
- "meta": {
- "key": "hour"
- }
- },
- "op": "==",
- "right": "00:00"
- }
- },
- {
- "drop": null
- }
-]
-
-# meta hour "00:01" drop
-[
- {
- "match": {
- "left": {
- "meta": {
- "key": "hour"
- }
- },
- "op": "==",
- "right": "00:01"
- }
- },
- {
- "drop": null
- }
-]
-
}
]
-# tcp flags { syn, syn | ack }
-[
- {
- "match": {
- "left": {
- "payload": {
- "field": "flags",
- "protocol": "tcp"
- }
- },
- "op": "==",
- "right": {
- "set": [
- "syn",
- {
- "|": [
- "syn",
- "ack"
- ]
- }
- ]
- }
- }
- }
-]
-
# tcp flags & (fin | syn | rst | psh | ack | urg) == { fin, ack, psh | ack, fin | psh | ack }
[
{
}
}
]
-
-# tcp flags fin,syn / fin,syn
-[
- {
- "match": {
- "left": {
- "&": [
- {
- "payload": {
- "field": "flags",
- "protocol": "tcp"
- }
- },
- {
- "|": [
- "fin",
- "syn"
- ]
- }
- ]
- },
- "op": "==",
- "right": {
- "|": [
- "fin",
- "syn"
- ]
- }
- }
- }
-]
-
-# tcp flags != syn / fin,syn
-[
- {
- "match": {
- "left": {
- "&": [
- {
- "payload": {
- "field": "flags",
- "protocol": "tcp"
- }
- },
- {
- "|": [
- "fin",
- "syn"
- ]
- }
- ]
- },
- "op": "!=",
- "right": "syn"
- }
- }
-]
-
-# tcp flags & (fin | syn | rst | ack) syn
-[
- {
- "match": {
- "left": {
- "&": [
- {
- "payload": {
- "field": "flags",
- "protocol": "tcp"
- }
- },
- {
- "|": [
- "fin",
- "syn",
- "rst",
- "ack"
- ]
- }
- ]
- },
- "op": "==",
- "right": "syn"
- }
- }
-]
-
-# tcp flags & (fin | syn | rst | ack) == syn
-[
- {
- "match": {
- "left": {
- "&": [
- {
- "payload": {
- "field": "flags",
- "protocol": "tcp"
- }
- },
- {
- "|": [
- "fin",
- "syn",
- "rst",
- "ack"
- ]
- }
- ]
- },
- "op": "==",
- "right": "syn"
- }
- }
-]
-
-# tcp flags & (fin | syn | rst | ack) != syn
-[
- {
- "match": {
- "left": {
- "&": [
- {
- "payload": {
- "field": "flags",
- "protocol": "tcp"
- }
- },
- {
- "|": [
- "fin",
- "syn",
- "rst",
- "ack"
- ]
- }
- ]
- },
- "op": "!=",
- "right": "syn"
- }
- }
-]
-
-# tcp flags & (fin | syn | rst | ack) == syn | ack
-[
- {
- "match": {
- "left": {
- "&": [
- {
- "payload": {
- "field": "flags",
- "protocol": "tcp"
- }
- },
- {
- "|": [
- "fin",
- "syn",
- "rst",
- "ack"
- ]
- }
- ]
- },
- "op": "==",
- "right": {
- "|": [
- "syn",
- "ack"
- ]
- }
- }
- }
-]
-
-# tcp flags & (fin | syn | rst | ack) != syn | ack
-[
- {
- "match": {
- "left": {
- "&": [
- {
- "payload": {
- "field": "flags",
- "protocol": "tcp"
- }
- },
- {
- "|": [
- "fin",
- "syn",
- "rst",
- "ack"
- ]
- }
- ]
- },
- "op": "!=",
- "right": {
- "|": [
- "syn",
- "ack"
- ]
- }
- }
- }
-]
-
-# tcp flags & (syn | ack) == syn | ack
-[
- {
- "match": {
- "left": {
- "&": [
- {
- "payload": {
- "field": "flags",
- "protocol": "tcp"
- }
- },
- {
- "|": [
- "syn",
- "ack"
- ]
- }
- ]
- },
- "op": "==",
- "right": {
- "|": [
- "syn",
- "ack"
- ]
- }
- }
- }
-]
-