Get or Set Custom Fields | LogRhythm Documentation

The following example illustrates how to get or set custom field values by using the SetCustomField and GetCustomField API.

function Flow_CustomMetaData (dpiMsg, ruleEngine)

require 'LOG'

local customName1 = "VPNData"

local customValue1 = "Tunnel"

local customValue2 = "SkypeTraffic"

local customName2 = "Voice"

SetCustomField(dpiMsg, customName1, customValue1);

SetCustomField(dpiMsg, customName1, customValue2);

SetCustomField(dpiMsg, customName2, customValue1);

local customTable1 = {GetCustomField(dpiMsg, customName1)};

local customTable2 = {GetCustomField(dpiMsg, customName2)};

for k,v in pairs(customTable1) do

EZINFO("Table 1: Value: ", v);

end

for k,v in pairs(customTable2) do

EZINFO("Table 2: Value: ", v);

end