: My First LUA Parser - converts LDAP://ou=blah,cn=blah,ou=blah blah/username into username - Useful for websense logs works on user.dst

[root@LOGDECCOL1 parsers]# more ldappath.lua

local ldappath = nw.createParser("LDAP_PATH", "Extract LDAP Path and username ")

--[[

    DESCRIPTION

        Extract the final username from an LDAP Path.

        Assumes Username is stored in user.dst

        If the username contains LDAP:// ..... .... /username then username gets put in user.dst field.

    VERSION

       26 November 2015 - Initial Developemnt

    AUTHOR

        david.waugh2@rsa.com

    DEPENDENCIES

        None

    NOTES

None

--]]

-- Since we are using an external module, we declare it here.

-- This must be in the parsers directory

-- These are the meta keys that we will write meta into

ldappath:setKeys({

nwlanguagekey.create("user.dst"),

})

-- This is our function.  What we want to do when we match a token...or in this case, the

-- URL meta callback.

function ldappath:urlMeta(index, url)

    local someURL = url

    local username = username

    --nw.logInfo("URL:  " .. url)

    -- check if the url contains the method (http:// or https:// typically) in first

    -- few bytes

        local first,last = string.find(url, "://", 1,10)

    if last then

        someURL = string.sub(someURL, last + 1, -1)

    end

    --nw.logInfo("someURL:  " .. someURL)

    foundPosition = string.find(someURL, "/")

    if foundPosition then

        username = string.sub(someURL,foundPosition+1,-1)

--nw.logInfo("username:  " .. username)

nw.createMeta(self.keys["user.dst"], username)

    end

end

ldappath:setCallbacks({

[nwlanguagekey.create("user.dst")] = ldappath.urlMeta,  -- this is the meta callback key

})