Tcpdump example using Expression LanguageTCPDump EL Example5c6e50bb-ded6-45fe-ba33-48922f15cf5e7c84501d-d10c-407c-b9f3-1d80e38fe36a182.64783416152994115.705797562028040Tcpdump example using Expression Language85e60282-8ba5-430d-a0a3-1549a0f5ecce5c6e50bb-ded6-45fe-ba33-48922f15cf5e0 MB05c6e50bb-ded6-45fe-ba33-48922f15cf5e123cde2d-e2dc-4d75-8d2f-c31500d2615bPROCESSOR0 sec1matched0b32a560b-a8cc-4564-92c5-b2479f3bb2895c6e50bb-ded6-45fe-ba33-48922f15cf5e0 MB05c6e50bb-ded6-45fe-ba33-48922f15cf5e7b110dd8-0e23-4cf4-9212-8b283f0967dePROCESSOR0 sec1splits05450c0f4-d629-41d8-bc92-48c86f33dac45c6e50bb-ded6-45fe-ba33-48922f15cf5e0 MB05c6e50bb-ded6-45fe-ba33-48922f15cf5e1d0a31a4-2fa6-4dc2-a04e-bcdb33f2a3f6PROCESSOR0 sec1web.server.dest04a57d7f6-2e6e-48c0-9273-d7b42f9db88e5c6e50bb-ded6-45fe-ba33-48922f15cf5e0 MB021.959213256835938294.6395254135132-15.240798950195312319.839537620544435c6e50bb-ded6-45fe-ba33-48922f15cf5ee06c1859-a881-4eae-8c75-81e4c016dceePROCESSOR0 sec1failure04573260c-781f-4924-93a4-013120ac3cd75c6e50bb-ded6-45fe-ba33-48922f15cf5e0 MB05c6e50bb-ded6-45fe-ba33-48922f15cf5ee06c1859-a881-4eae-8c75-81e4c016dceePROCESSOR0 sec1success0123cde2d-e2dc-4d75-8d2f-c31500d2615b5c6e50bb-ded6-45fe-ba33-48922f15cf5e459.95922037760397383.5418518702189WARN1TIMER_DRIVEN1EVENT_DRIVEN0CRON_DRIVEN1TIMER_DRIVEN0 secCRON_DRIVEN* * * * * ?Routing StrategyA copy of the FlowFile will be routed to each relationship whose corresponding expression evaluates to 'true'Route to Property nameRoute to Property nameRequires that all user-defined expressions evaluate to 'true' for the FlowFile to be considered a matchRoute to 'matched' if all matchRoute to 'match' if all matchRequires that at least one user-defined expression evaluate to 'true' for hte FlowFile to be considered a matchRoute to 'matched' if any matchesRoute to 'match' if any matchesRoute to Property nameSpecifies how to determine which relationship to use when evaluating the Expression LanguageRouting StrategyfalseRouting Strategytruefalsefalseweb.server.destweb.server.desttrueweb.server.destfalsefalsetruefalse30 secRouting StrategyRoute to Property nameweb.server.dest${dest.socket:endsWith(".9090")}00 secTIMER_DRIVEN1 secRouteOnAttributetrueFlowFiles that do not match any user-define expression will be routed hereunmatchedfalseweb.server.destSTOPPEDtruetrueorg.apache.nifi.processors.standard.RouteOnAttributee06c1859-a881-4eae-8c75-81e4c016dcee5c6e50bb-ded6-45fe-ba33-48922f15cf5e-224.74080403645848126.73955694834393WARN1TIMER_DRIVEN1EVENT_DRIVEN0CRON_DRIVEN1TIMER_DRIVEN0 secCRON_DRIVEN* * * * * ?Line Split CountThe number of lines that will be added to each split fileLine Split CountfalseLine Split CounttruefalsefalseHeader Line Count0The number of lines that should be considered part of the header; the header lines will be duplicated to all split filesHeader Line CountfalseHeader Line CounttruefalsefalseRemove Trailing NewlinestruetruefalsefalsetrueWhether to remove newlines at the end of each split file. This should be false if you intend to merge the split files laterRemove Trailing NewlinesfalseRemove Trailing Newlinestruefalsefalsefalse30 secLine Split Count1Header Line Count0Remove Trailing Newlinestrue00 secTIMER_DRIVEN1 secSplitTextfalseIf a file cannot be split for some reason, the original file will be routed to this destination and nothing will be routed elsewherefailuretrueThe original input file will be routed to this destination when it has been successfully split into 1 or more filesoriginalfalseThe split files will be routed to this destination when an input file is successfully split into 1 or more split filessplitsSTOPPEDtruetrueorg.apache.nifi.processors.standard.SplitText93ab44d9-ad49-4078-8129-b72075d2e0a45c6e50bb-ded6-45fe-ba33-48922f15cf5e-742.835683186849126.8480774561564WARN1TIMER_DRIVEN1EVENT_DRIVEN0CRON_DRIVEN1TIMER_DRIVEN0 secCRON_DRIVEN* * * * * ?CommandSpecifies the command to be executed; if just the name of an executable is provided, it must be in the user's environment PATH.CommandfalseCommandtruefalsefalseCommand ArgumentsThe arguments to supply to the executable delimited by white space. White space can be escaped by enclosing it in double-quotes.Command ArgumentsfalseCommand ArgumentsfalsefalsefalseBatch DurationIf the process is expected to be long-running and produce textual output, a batch duration can be specified so that the output will be captured for this amount of time and a FlowFile will then be sent out with the results and a new FlowFile will be started, rather than waiting for the process to finish before sending out the resultsBatch DurationfalseBatch DurationfalsefalsefalseRedirect Error StreamtruetruefalsefalsefalseIf true will redirect any error stream output of the process to the output stream. This is particularly helpful for processes which write extensively to the error stream or for troubleshooting.Redirect Error StreamfalseRedirect Error Streamfalsefalsefalsefalse30 secCommandsudoCommand Argumentstcpdump -n -nnBatch Duration500 msRedirect Error Streamfalse00 secTIMER_DRIVEN1 secExecuteProcessfalseAll created FlowFiles are routed to this relationshipsuccessSTOPPEDfalsetrueorg.apache.nifi.processors.standard.ExecuteProcess1d0a31a4-2fa6-4dc2-a04e-bcdb33f2a3f65c6e50bb-ded6-45fe-ba33-48922f15cf5e-12.840828450520917413.4394653956096WARN1TIMER_DRIVEN1EVENT_DRIVEN0CRON_DRIVEN1TIMER_DRIVEN0 secCRON_DRIVEN* * * * * ?Log LeveltracetracedebugdebuginfoinfowarnwarnerrorerrorinfoThe Log Level to use when logging the AttributesLog LevelfalseLog LeveltruefalsefalseLog PayloadtruetruefalsefalsefalseIf true, the FlowFile's payload will be logged, in addition to its attributes; otherwise, just the Attributes will be logged.Log PayloadfalseLog PayloadtruefalsefalseAttributes to LogA comma-separated list of Attributes to Log. If not specified, all attributes will be logged.Attributes to LogfalseAttributes to LogfalsefalsefalseAttributes to IgnoreA comma-separated list of Attributes to ignore. If not specified, no attributes will be ignored.Attributes to IgnorefalseAttributes to Ignorefalsefalsefalsefalse30 secLog LevelLog PayloadAttributes to LogAttributes to Ignore00 secTIMER_DRIVEN1 secLogAttributetrueAll FlowFiles are routed to this relationshipsuccessSTOPPEDtruetrueorg.apache.nifi.processors.standard.LogAttribute7b110dd8-0e23-4cf4-9212-8b283f0967de5c6e50bb-ded6-45fe-ba33-48922f15cf5e382.259318033854139.13952032725018WARN1TIMER_DRIVEN1EVENT_DRIVEN0CRON_DRIVEN1TIMER_DRIVEN0 secCRON_DRIVEN* * * * * ?Character SetUTF-8The Character Set in which the file is encodedCharacter SetfalseCharacter SettruefalsefalseMaximum Buffer Size1 MBSpecifies the maximum amount of data to buffer (per file) in order to apply the regular expressions. Files larger than the specified maximum will not be fully evaluated.Maximum Buffer SizefalseMaximum Buffer SizetruefalsefalseMaximum Capture Group Length1024Specifies the maximum number of characters a given capture group value can have. Any characters beyond the max will be truncated.Maximum Capture Group LengthfalseMaximum Capture Group LengthfalsefalsefalseEnable Canonical EquivalencetruetruefalsefalsefalseIndicates that two characters match only when their full canonical decompositions match.Enable Canonical EquivalencefalseEnable Canonical EquivalencetruefalsefalseEnable Case-insensitive MatchingtruetruefalsefalsefalseIndicates that two characters match even if they are in a different case. Can also be specified via the embeded flag (?i).Enable Case-insensitive MatchingfalseEnable Case-insensitive MatchingtruefalsefalsePermit Whitespace and Comments in PatterntruetruefalsefalsefalseIn this mode, whitespace is ignored, and embedded comments starting with # are ignored until the end of a line. Can also be specified via the embeded flag (?x).Permit Whitespace and Comments in PatternfalsePermit Whitespace and Comments in PatterntruefalsefalseEnable DOTALL ModetruetruefalsefalsefalseIndicates that the expression '.' should match any character, including a line terminator. Can also be specified via the embeded flag (?s).Enable DOTALL ModefalseEnable DOTALL ModetruefalsefalseEnable Literal Parsing of the PatterntruetruefalsefalsefalseIndicates that Metacharacters and escape characters should be given no special meaning.Enable Literal Parsing of the PatternfalseEnable Literal Parsing of the PatterntruefalsefalseEnable Multiline ModetruetruefalsefalsefalseIndicates that '^' and '$' should match just after and just before a line terminator or end of sequence, instead of only the begining or end of the entire input. Can also be specified via the embeded flag (?m).Enable Multiline ModefalseEnable Multiline ModetruefalsefalseEnable Unicode-aware Case FoldingtruetruefalsefalsefalseWhen used with 'Enable Case-insensitive Matching', matches in a manner consistent with the Unicode Standard. Can also be specified via the embeded flag (?u).Enable Unicode-aware Case FoldingfalseEnable Unicode-aware Case FoldingtruefalsefalseEnable Unicode Predefined Character ClassestruetruefalsefalsefalseSpecifies conformance with the Unicode Technical Standard #18: Unicode Regular Expression Annex C: Compatibility Properties. Can also be specified via the embeded flag (?U).Enable Unicode Predefined Character ClassesfalseEnable Unicode Predefined Character ClassestruefalsefalseEnable Unix Lines ModetruetruefalsefalsefalseIndicates that only the '
' line terminator is recognized in the behavior of '.', '^', and '$'. Can also be specified via the embeded flag (?d).Enable Unix Lines ModefalseEnable Unix Lines ModetruefalsefalseInclude Capture Group 0truetruefalsefalsetrueIndicates that Capture Group 0 should be included as an attribute. Capture Group 0 represents the entirety of the regular expression match, is typically not used, and could have considerable length.Include Capture Group 0falseInclude Capture Group 0truefalsefalsedest.socketdest.sockettruedest.socketfalsefalsefalsesrc.socketsrc.sockettruesrc.socketfalsefalsefalsefalse30 secCharacter SetUTF-8Maximum Buffer Size1 MBMaximum Capture Group Length1024Enable Canonical EquivalencefalseEnable Case-insensitive MatchingfalsePermit Whitespace and Comments in PatternfalseEnable DOTALL ModefalseEnable Literal Parsing of the PatternfalseEnable Multiline ModefalseEnable Unicode-aware Case FoldingfalseEnable Unicode Predefined Character ClassesfalseEnable Unix Lines ModefalseInclude Capture Group 0dest.socket>\s+(\d+\.\d+\.\d+\.\d+\.\d+)src.socket(\d+\.\d+\.\d+\.\d+\.\d+)\s+>00 secTIMER_DRIVEN1 secExtractTextfalseFlowFiles are routed to this relationship when the Regular Expression is successfully evaluated and the FlowFile is modified as a resultmatchedtrueFlowFiles are routed to this relationship when no provided Regular Expression matches the content of the FlowFileunmatchedSTOPPEDtruetrueorg.apache.nifi.processors.standard.ExtractText0000TCPDump EL Example07c84501d-d10c-407c-b9f3-1d80e38fe36aNiFi Flow0511/18/2015 02:54:06 UTC