Product Documentation

Advanced Expressions

Jun 13, 2016

An advanced expression has the following basic form:

prefix.operation

where,

  • prefix - is a period-delimited key that identifies a unit of data.

    For example, the prefix to examine HTTP requests for the presence of a header named "Content-Type" is as follows:

    HTTP.REQ.HEADER("Content-Type")
  • operation - specifies the action that must be performed on the data that is specified by the prefix.

    Using the above example, the operation to check if the value of the header is equal to "text/html" is as follows:

    EQ("text/html")

The fully formed expression for the above example is as follows:

HTTP.REQ.HEADER("Content-Type").EQ("text/html")

提示

A prefix can be used by itself, that is without an operation, when you want the value of the object that the prefix identifies.

Compound Expressions

You can combine multiple fully-formed expressions to create a compound expression that has the following basic form:

prefix.operation <operator> prefix.operation [<operator> prefix.operation. . .] 

where,

  • prefix.operation - is the fully formed expressions that must be evaluated along with other fully formed expressions.

  • <operator> - can be any one of the operators that are detailed in the following topic.
For details on the available operators, see Operators in Advanced Expressions.

提示

You can use parentheses to control the order of evaluation of an expression. The following is an example:

HTTP.REQ.URL.CONTAINS("myCompany.com") || (HTTP.REQ.URL.HOSTNAME.EQ("myHost") && HTTP.REQ.HEADER("myHeader").EXISTS)