Condition fields reference#

Standard request fields#

field description
http.host Value of the Host header
http.referer Value of Referer request header.
http.request.headers map of lowercase header names to array of bytes
http.request.method Request method ("GET").
http.request.uri Full path with query ("/path?query*value").
http.request.uri.path Path only without query ("/path").
http.request.uri.query Query only without starting ? ("query*value").
http.request.version HTTP version ("HTTP/1.1").
http.user_agent Value of User-Agent request header.
ip.src IP address. ("127.0.0.1", "1").
ssl Whether the request is over TLS

Standard response fields#

field description
http.response.code HTTP response code as integer
http.response.headers map of lowercase header names to array of bytes

GeoIP fields#

field description
ip.geoip.asnum int, AS number
ip.geoip.country country code

User agent fields#

field description
user_agent.bot boolean. True if parsed user agent is detected as bot
user_agent.bot.type none, other, google, yandex, bing, facebook, alexa, apple, pinterest, petal, yahoo, duckduckgo, stripe, letsencrypt, ahrefs, semrush
user_agent.mobile boolean
user_agent.software unknown, browser, app, site-monitor, search-bot, bot
user_agent.type unknown, browser, mobile, bot, search-bot, email

Bot fields#

field description
bot.verified boolean. True if bot is verified.
bot.verification_state unknown, verifying, error, unverified, verified

Fingerprint ML fields#

field description
fingerprint.ml map of class names (string) to score (0-100)