Grok Filter want to see only the processname - logstash

I want to see only the Process cmd.exe.
Example:
New Process Name: C:\Windows\System32\cmd.exe Token Elevation Type: %%1938 Creator Process ID: 0x1a0`enter code here`
Grok Filter:
New Process Name: %{GREEDYDATA}\\%{GREEDYDATA:Process}
Output:
{
"Process": [
[
"cmd.exe Token Elevation Type: %%1938 Creator Process ID: 0x1a0`enter code here`"
]
]
}
How i get to see only cmd.exe and not Token Elevation Type: %%1938 Creator Process ID: 0x1a0`enter?

GREEDYDATA usually means "everything". I find it usually not be useful except at the end of a pattern (as a catch-all).
So, you're asking for everything after the backslash, which is what you're getting.
How about:
New Process Name: %{GREEDYDATA}\\%{NOTSPACE:Process}

Related

queryText being sent to Dialogflow is not the original user query

The user input / queryText being sent to Dialogflow is not the expected, original user query.
simulator query manipulation
I enabled "Log interactions to Google Cloud" in my Dialogflow project's settings. What I'm seeing is multiple "assistant_action" resources before the actual request that goes to DF. In the example above, this is what I see:
GCP logs
With the first debug resource showing post data with:
"inputs":[{"rawInputs":[{"inputType":"UNSPECIFIED_INPUT_TYPE","query":"how long has it been on the market"}]
And
resource: {
type: "assistant_action"
labels: {
project_id: "<MY-PROJECT-ID>"
version_id: ""
action_id: ""
}
},
timestamp: "2021-03-05T18:41:44.142202856Z"
severity: "DEBUG"
labels: {
channel: "production"
querystream: "GOOGLE_USER"
source: "AOG_REQUEST_RESPONSE"
}
The subsequent requests are the same but with modified input queries ("how long has it been on the market" -> "how long has something been on the market" -> "how long has us FDA been on the market"), the last one being the actual user query sent, the channel being preview and the action_id "actions.intent.TEXT".
resource: {
type: "assistant_action"
labels: {
project_id: "<MY-PROJECT-ID>"
version_id: ""
action_id: "actions.intent.TEXT"
}
},
timestamp: "2021-03-05T18:41:45.942019959Z"
severity: "DEBUG"
labels: {
channel: "preview"
querystream: "GOOGLE_USER"
source: "AOG_REQUEST_RESPONSE"
}
I should note that I am testing current drafts of an AoG project and have no releases let alone a production release. I have a denied beta, because of branding issues which I address with separate AoG/DF projects for PROD. I do not have any intents enabled for slot filling or any required entity parameters. This is just one example, but I have been noticing many occurrences of this issue.
What is happening here? Why is the original user input being manipulated? What are all these interactions we are seeing before the expected request/response cycle?
After having contacted someone at Google Cloud, I was informed this was something that had been raised by others and that AoG devs were looking into it.
As of a Mar 24 2021 release, I can no longer replicate this Entity Resolution issue.

swaggerhub and REST API

I use swaggerHub for write the documentation of my new app Node but I have a problem with one api.
My API require two params.
Example : POST http://cloud.amazingwebsite.com/:service/:action
Ok, if you want to use this API, you must to give two values. My problem is that the doc of swaggerHub propose only examples with one param.
Please, do you have a example with two params ? Is it possible ? Thanks
If you do it like this:
"/{service}/{action}":
x-swagger-router-controller: serviceController
post:
summary: To perform an action
operationId: serviceAction
parameters:
- name: service
in: path
required: true
type: string
description: Request Path Param for service
- name: action
in: path
required: true
type: string
description: Request Path Param for Action
responses:
'200':
description: Success
schema:
"$ref": "#/definitions/SuccessResponse"
default:
description: Error
schema:
"$ref": "#/definitions/ErrorResponse"
definitions:
SuccessResponse:
type: object
ErrorResponse:
required:
- error
properties:
error:
type: string

In Cloudformation YAML, use a Ref in a multiline string (? use Fn:Sub)

Imagine you have a aws resource such as
Resources:
IdentityPool:
Type: "AWS::Cognito::IdentityPool"
Properties:
IdentityPoolName: ${self:custom.appName}_${self:provider.stage}_identity
CognitoIdentityProviders:
- ClientId:
Ref: UserPoolClient
The Ref for "AWS::Cognito::IdentityPool" returns the id of this resource. Now lets say I want to reference that id in a multiline string. I've tried
Outputs:
AmplifyConfig:
Description: key/values to be passed to Amplify.configure(config);
Value: |
{
'aws_cognito_identity_pool_id': ${Ref: IdentityPool}, ##<------ Error
'aws_sign_in_enabled': 'enable',
'aws_user_pools_mfa_type': 'OFF',
}
I've also tried to use Fn:Sub but without luck.
AmplifyConfig:
Description: key/values to be passed to Amplify.configure(config);
Value:
Fn::Sub
- |
{
'aws_cognito_identity_pool_id': '${Var1Name}',
'aws_sign_in_enabled': 'enable',
}
- Var1Name:
Ref: IdentityPool
Any way to do this?
Using a pipe symbol | in YAML turns all of the following indented lines into a multi-line string.
A pipe, combined with !Sub will let you use:
your resources Ref return value easily like ${YourResource}
their Fn::GetAtt return values with just a period ${YourResource.TheAttribute}
any Pseudo Parameter just as is like ${AWS:region}
As easy as !Sub |, jumping to the next line and adding proper indentation. Example:
Resources:
YourUserPool:
Type: AWS::Cognito::UserPool
Properties:
UserPoolName: blabla
Outputs:
AmplifyConfig:
Description: key/values to be passed to Amplify.configure(config);
Value: !Sub |
{
'aws_cognito_identity_pool_id': '${YourUserPool}',
'aws_sign_in_enabled': 'enable',
'aws_user_pools_mfa_type': 'OFF',
}
AdvancedUsage:
Description: use Pseudo Parameters and/or resources attributes
Value: !Sub |
{
'aws_region': '${AWS::Region}',
'user_pool_arn': '${YourUserPool.Arn}',
}
I found out how to do this using Join
AmplifyConfig:
Description: key/values to be passed to Amplify.configure(config);
Value:
Fn::Join:
- ''
- - "{"
- "\n 'aws_cognito_identity_pool_id':"
- Ref : IdentityPool
- "\n 'aws_user_pools_id':"
- Ref : UserPool
- "\n 'aws_user_pools_web_client_id':"
- Ref : UserPoolClient
- ",\n 'aws_cognito_region': '${self:provider.region}'"
- ",\n 'aws_sign_in_enabled': 'enable'"
- ",\n 'aws_user_pools': 'enable'"
- ",\n 'aws_user_pools_mfa_type': 'OFF'"
- "\n}"
This works but it's kinda ugly. I'm going to leave this answer unaccepted for a while to see if anyone can show how to do this with Fn::Sub.
Using YAML you could compose this simply:
Outputs:
AmplifyConfig:
Description: key/values to be passed to Amplify.configure(config);
Value: !Sub '
{
"aws_cognito_identity_pool_id": "${IdentityPool}",
"aws_sign_in_enabled": "enable",
"aws_user_pools_mfa_type": "OFF",
}'
Leaving this here as I encountered a Base64 encoding error when doing something similar and this question came up when searching for
a solution.
In my case I was a using multi line string + !Sub to populate UserData and receiving the following error in AWS Cloudformation.
Error:
Invalid BASE64 encoding of user data. (Service: AmazonEC2; Status
Code: 400; Error Code: InvalidUserData.Malformed; Request ID: *;
Proxy: null)
Solution:
Can be solved by combining two built in Cloudformation functions; Fn::Base64 and !Sub:
UserData:
Fn::Base64: !Sub |
#!/bin/bash
echo ${SomeVar}

jsonix properties - ogc-schemas .js aren't same

The manual on jsonix properties at https://github.com/highsource/jsonix/wiki/Properties shows properties as being something like:
name: 'MyModule',
typeInfos: [{
type: 'classInfo',
localName: 'InputType',
propertyInfos: [{
type: 'attribute',
typeInfo: 'Boolean',
name: 'checked'
}]
}],
But then (after npm install ogc-schemas) what I am seeing is:
ln: 'TimeClockPropertyType',
ps: [{
n: 'timeClock',
rq: true,
en: 'TimeClock',
ti: '.TimeClockType'
},
With the abbreviated names.
Which should it be and why doesn't it matter if it doesn't?
Disclaimer: I'm the author of jsonix.
This is what's called compact naming. This is an option of the Jsonix Schema Compiler which generates shorter names in mappings, like n instead of name or dens instead of defaultElementNamespaceURI. The goal is clearly to make mappings smaller and since ogc-schemas are pretty large, they are compiled with compact naming by default.
If you want standard naming, fork and remove
<arg>-Xjsonix-compact</arg>
from all the pom.xmls.
Both compact and standard names work in runtime, I think standard names have higher priority.

Yeoman Get Options

I wrote this code:
this.option('username', {
alias: 'u',
name: 'Username',
desc: 'A username used for Marketplace authentication',
type: String,
required: true
});
console.log(this.options.username);
I input the below in my terminal:
yo test -username MrZerg
I get back:
true
But I expect: "MrZerg"!
yo is using meow to parse command line input. I think you need a double -- for options input. Try with yo test --username MrZerg

Resources