Wirefilter#

The wirefilter language is used to define a filter to identify matching requests and responses. The language is used within the Peakhour.IO rules system during the lifecycle of a request and defines the available fields during the lifecycles. Available fields are dependent on the phase of the request, and operators and functions can assist in defining complex criteria.

Comparison operators#

Fields can be compared against values using the following notation

operator comparison
eq, == Equal
ne, != Not Equal
gt, > Greater Than
lt, < Less Than
ge, >= Greater than or Equal to
le, <= Less than or Equal to

For example, to filter for requests from a given IP address:

ip.src eq 1.1.1.1

Search and match operators#

contains#

The "contains" operator allows a filter to search for a sequence of characters, expressed as a string. For example, to search for a given HTTP URL, the following filter can be used:

http.request.uri contains ".html"

Would match requests that contain ".html"

Functions#

Functions assist with comparison.

Logical expressions#

Tests can be combined using logical expressions:

operator operator
and, && Logical AND
or, Logical OR
not, ! Logical NOT

expressions can also be grouped using parentheses:

(ip.src eq 1.1.1.1 or ip.src eq 1.1.1.1) and http.request.uri eq "/"

Membership operator#

A field may be checked for matches against a set of values using the membership operator. As an example, to check against several IP addresses:

ip.src in {1.1.1.1,2.2.2.2}

is equivalent to

ip.src eq 1.1.1.1 or ip.src eq 2.2.2.2