How to get the substring when matched a rule? about hyperscan HOT 1 CLOSED

Hi there,

Questions here (or on the mailing list) are fine!

What you're asking for is capturing group support, which Hyperscan does not support. Hyperscan will only provide the end-offset of a match, or both the start- and end-offsets if you use the HS_FLAG_SOM_LEFTMOST flag.

Probably the best way to do what you're trying to do with Hyperscan is to perform some further processing in the match callback when Hyperscan finds a match. Depending on how stylized your patterns are, you could use some sort of string matching (as you've suggested), or a single-regex matcher that supports capturing groups, like PCRE, to extract the sub-match data you need.

from hyperscan.