| 用途 | 字段包含子串/字节匹配 |
|---|---|
| 语法 | 字段 contains "子串" 或 字段 contains 12:34:56 |
常用示例
常用示例
http.request.uri contains "/api/v2"
http.host contains "internal"
dns.qry.name contains "cdn"
tcp contains "password"contains 对大小写敏感,需不区分大小写可在正则版用 matches "(?i)..."。
contains 判断字段值是否包含子串或字节序列,适合搜索 URL、Host、User-Agent 等不确定完整值的内容。
| 用途 | 字段包含子串/字节匹配 |
|---|---|
| 语法 | 字段 contains "子串" 或 字段 contains 12:34:56 |
http.request.uri contains "/api/v2"
http.host contains "internal"
dns.qry.name contains "cdn"
tcp contains "password"