Filter expression examples
This page lists the examples of valid filter expressions used for defining the traffic segment that is monitored by the child Watchpoint.
Examples of valid filter expressions
Filter expression | Filter criteria |
---|---|
browser_id contains "chrome" | The name of the browser that the client is using |
client_ip match 192.10.2.12 | IP address of the client that generated the request |
client_port > 0 | TCP port of the client from which the request was generated |
collector_feed_names contains "abc" | Real User Collector feed name |
conditions = 1 | Number of informational conditions for this session, page, or object for the specific category:
|
cookie_param("jid") contains "abc" ignorecase any | Cookies sent from the client to the server |
credentials is "QWxhZGRpbjpvcGVuIHNlc2FtZQ==" | Basic authentication (credentials) |
err_count = 100 err_nw_count > 0 err_client_count < 10 err_count != 10 err_app_count >= 10 err_content_count = null err_custom_count between 5 10 | Number of error conditions for this session, page, or object for the specific category:
|
false | Refuses all traffic |
first_public_ip = 102.2.2.3 | First public IP found in x-forwarded-for (or client IP) |
first_public_geo.city contains "mtl" | Geolocation criteria:
|
group_id is "Shoppers" | A group token extracted from traffic |
http_method is "GET" | The HTTP action (GET, POST, or HEAD) for this request |
http_status = 200 | The HTTP status code provided by the server |
http_version is "HTTP/1.1" | The version of HTTP used by this client and the server |
info_count = 100 info_nw_count > 0 info_client_count < 10 info_count != 10 info_app_count >= 10 info_content_count = null info_custom_count between 5 10 | Number of informational conditions for this session, page, or object for the specific category:
|
is_container = True | Indicates whether this object is a container, such as an HTML page, that can “contain” other objects (for example, CSS, images, and so on) |
is_component = True | Indicates whether this object represents a page component (for example, an image, a stylesheet, or a script file) |
is_document = True | Indicates whether this object is a document |
is_ipv4 = True | Indicates whether this is the IPv4 traffic |
is_ipv6 = True | Indicates whether this is the IPv6 traffic |
is_aborted = True | Indicates whether this request was aborted |
is_expired = True | Indicates whether this page or object has expired |
is_full_origin_page = True | Indicates whether this page or object is served by the origin server |
is_prm_instrumented = True | Indicates whether this page or object is instrumented (with page-render beacon) |
is_promoted_document = True | Indicates whether this item was involved in the creation of a promoted document During Object-type detection, when a hit (HTTP request and response pair) is classified as a Component and no associated parent Container is detected, it is determined to be orphaned. This parameter can be used to identify a page component orphan that results from misconfiguration or traffic patterns. For example, if a user clicks a thumbnail link on a web page to view the full image, it is classified as a Component. However, if the full image is displayed long after a page timeout, it is promoted and classified as a Document because the user clicked and received a new page without children components. |
is_secure = True | Indicates whether this page or object was transferred securely |
is_server_aborted = True | Indicates whether this object was aborted by the server |
is_no_response = True | Indicates whether this object was aborted after the request was completed but before the server could start sending the response |
is_mid_request = True | Indicates whether this object was aborted while the request was still being sent |
is_mid_response = True | Indicates whether this object was aborted while the response was being sent |
is_timed_out = True | Indicates whether this object timed out before the request or response was completed |
is_client_timed_out = True | Indicates whether this object timed out while waiting for the client |
is_server_timed_out = True | Indicates whether this object timed out while waiting for the server |
time_host > 200 | Latency time, ms:
|
mime_type is "text / html" ignorecase | The MIME type of content contained in the response |
os contains "win" | The common name of the client's operating system |
time_idle < 10 | Time the browser took to request more objects during the loading of a page, ms |
page_name contains "login" | Name of the page as defined by the user |
count_object > 12 | Number of objects in the session |
count_primary_redirect > 1 | Number of primary redirects |
page_referrer contains "index" | Name of the referring page |
time_page_render > 10 | Page-render time, ms |
count_secure > 10 | Number of secure pages in this session |
slt_broken | Indicates whether the page violates the service-level threshold (SLT) |
count_redirect > 1 | Number of redirects for this session |
post_param("parameter") between "foo" "bar" | POST parameter passed from the client to the server |
post_param_string contains "username=bill&language=english" ignorecase | Zero or more parameters passed from the client to the server as the name/value pairs when completing a form |
url_redirect.path[2] startswith "abc" ignorecase all url_redirect.path_param[last -1]("id") is "abc" occurs 5 url_redirect.query_string contains "abc" url_redirect.query_param("jesson") is "abc" occurs 5- url_redirect.stem_string contains "abc" url_redirect contains "abc" url_redirect.extension endswith "txt" url_redirect.host contains "abc" url_redirect.port = 123 url_redirect.protocol contains "http" | Redirect URL:
|
url_referrer.path[2] startswith "abc" ignorecase all url_referrer.path_param[3]("sid") is "123" url_referrer.query_string contains "abc" url_referrer.query_param("jesson") is "abc" occurs 5- url_referrer.stem_string contains "abc" url_referrer contains "abc" url_referrer.extension endswith "txt" url_referrer.host contains "abc" url_referrer.port = 123 url_referrer.protocol contains "http" | Referrer URL:
|
server_id contains "abc" | Server parameters:
|
setcookie_param("sid") contains "abc" | Server cookie parameter |
setcookie_string startswith "SESSIONID=1232897" | The cookie header passed from the client to the server |
size > 2000 | Size of the object or page (request + response), bytes |
size_kb > 20 | Size of the object or page (request + response), kilobytes |
tcp_ooo > 2 tcp_packet_count > 10 tcp_rtx > 20 tcp_rtt < 300 tcp_rtt_tap2server > 100 tcp_rtt_tap2client >= 20 | TCP-related filters:
|
throughput < 200 | Effective throughput in bits per second. May be blank if the request was too small to accurately measure throughput |
true | Accept all traffic |
url.path[1] startswith "abc" url.path_param[2]("sid") is "abc url.query_string contains "action=search&type=byarea" ignorecase url.query_param("ssid") is "abc" url.stem_string contains "/home/search.jsp" url contains "abc" url.extension endswith "html" url.host contains "abc" url.port = 622 url.protocol contains "https" | URL-related filters:
|
ssl_cert_common_name contains "dsl" | SSL certificate common name |
user_agent contains "fire" | The user-agent string contained in the header of the request. This string contains information concerning the user's environment, for example, browser type, OS, and so on. |
vm_display_name contains "abc" | Virtual machine (VM) display name |
vmm_dns_name contains "abc" | VM manager domain name service (DNS) name |
ph_dns_name contains "abc" | VM physical host |
application_name is "abc" | The name of the application invoked by the client |
trace is "abc" | The header, inserted by application-monitoring solutions to enable drill-downs extracted from the HTTP response |
Related topics
Comments
Log in or register to comment.