From 031995d4b9af0518ce03c39ab70ad14531ef76ae Mon Sep 17 00:00:00 2001 From: Mark Veidemanis Date: Thu, 12 Jan 2023 07:20:48 +0000 Subject: [PATCH] Allow partial matching on msg field --- core/lib/rules.py | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/core/lib/rules.py b/core/lib/rules.py index 7e2c67a..5619b7e 100644 --- a/core/lib/rules.py +++ b/core/lib/rules.py @@ -76,6 +76,18 @@ def process_rules(data): break # Continue to next field continue + + # Allow partial matches for msg + if field == "msg": + for msg in value: + if "msg" in message: + if msg in message["msg"]: + matched_field_number += 1 + matched_fields.append(field) + # Break out of the msg matching loop + break + # Continue to next field + continue if field in message and message[field] in value: matched_field_number += 1 matched_fields.append(field)