Sequences with URI's are not matched correctly

[Leftium]

Steps to Reproduce:

1. echo "get http://example.com" > input.txt
2. go run sequence.go analyze --input input.txt --output patterns.txt
3. go run sequence.go parse --input input.txt --patterns patterns.txt

Expected Results:

Message is parsed and there is no error.

Actual Results:

2016/05/12 12:18:40 Error (sequence: no pattern matched for this message) parsing: get http://example.com
2016/05/12 12:18:40 Parsed 1 messages in 0.00 secs, ~ 999.90 msgs/sec
2016/05/12 12:18:40 Quiting...

Comments:

There is no error and the results are correct if the URI is removed. I think the URI fails to match because the scanner says it is type uri but the patterns file is looking for %object%.

I was unable to confirm this because %uri% is not accepted in a patterns file (Invalid tag token "%uri%": unknown type). And I have not figured out how to prevent the URI from being tagged as an object.

Also note this bug causes the analyze command to report the incorrect number of new patterns.

[leolee192]

Since I tried and couldn't contact the original author for weeks, I decided to migrate the project to leolee192/sequencer. Please visit leolee192/sequencer#9 for further activity, or to subscribe to receive notifications.