A powerful whois query processor primary designed to enrich DataFlows with whois based APIs (e.g. ShadowServer's ASN lookup) but that can be also used to perform regular whois lookups.


whois, enrich, ip


In the list below, the names of required properties appear in bold. Any other properties (not in bold) are considered optional. The table also indicates any default values, and whether a property supports the NiFi Expression Language.

Display NameAPI NameDefault ValueAllowable ValuesDescription
Lookup valueQUERY_INPUTThe value that should be used to populate the query
Supports Expression Language: true (will be evaluated using flow file attributes and variable registry)
Whois Query TypeWHOIS_QUERY_TYPEThe Whois query type to be used by the processor (if used)
Whois ServerWHOIS_SERVERThe Whois server to be used
Whois Server PortWHOIS_SERVER_PORT43The TCP port of the remote Whois server
Whois Query TimeoutWHOIS_TIMEOUT1500 msThe amount of time to wait until considering a query as failed
Batch SizeBATCH_SIZE25The number of incoming FlowFiles to process in a single execution of this processor.
Bulk ProtocolBULK_PROTOCOLNone
  • Begin/End The evaluated input of each flowfile is enclosed within begin and end tags. Each row contains a delimited set of fields
  • None Queries are made without any particular dialect
The protocol used to perform the bulk query.
Results ParserQUERY_PARSERNone
  • Split Use a delimiter character or RegEx  to split the results into attributes
  • RegEx Use a regular expression to split the results into attributes
  • None Do not split results
The method used to slice the results into attribute groups
Parser RegExQUERY_PARSER_INPUTChoice between a splitter and regex matcher used to parse the results of the query into attribute groups. NOTE: This is a multiline regular expression, therefore, the DFM should decide how to handle trailing new line characters.
Key lookup group (multiline / batch)KEY_GROUPWhen performing a batched lookup, the following RegEx numbered capture group or Column number will be used to match the whois server response with the lookup field


not foundWhere to route flow files if data enrichment query rendered no results
foundWhere to route flow files after successfully enriching attributes with data

Reads Attributes:

None specified.

Writes Attributes:

enrich.dns.record*.group*The captured fields of the Whois query response for each of the records received

State management:

This component does not store state.


This component is not restricted.

Input requirement:

This component requires an incoming relationship.

System Resource Considerations:

None specified.