Math Expression Filter

Definition

Description

If event matches Condition set FieldName to math expression String.

 

 

Comments

Only events matching the Condition are considered by the filter.

If FieldName or math expression String are missing, blank or invalid the filter will be disabled.

Math expression features:

1. Operators:

Operator Explanation
+ plus, add
- minus, subtract
* multiply
/ divide

2. Arithmetic operator precedence

3. Operation grouping with parentheses

4. Supported functions (variables "a", "b", … are floating point IEEE 754 doubles):

Syntax Explanation
inc( a ) increment by 1
dec( a ) decrement by 1
abs( a ) take absolute value
min( a, b, ...) select smallest
max( a, b, ...) select largest
exp( a ) e^a
div( a, b ) a/b (integer division, no remainder)
mod( a, b ) a % b (remainder of integer division)

5. FieldName will be set to the results of the numeric expression String. Fields that don't exist or cannot be converted to numbers will evaluate to 0. If the math expression has errors, field "ev:mathfilter.errors" will hold a formatted error string.

Example:
%FieldName% = ev:ans
%String% = "1 + 2 * 3 + inc(ev:number) + ev:string"

event in = { host=host, app=app, log=log, ev:number=10, ev:string=test }

event out = { host=host, app=app, log=log, ev:number=10, ev:string=test, ev:ans=18 }

[expression evaluates as: 1 + 6 + 11 + 0 = 18]

 

Example

<filter objectId="Filter.Math" type="MathFilter">
	<parameter type="Condition">
		<negatePrimaryCondition>false</negatePrimaryCondition>
		<conditionRelation>Any</conditionRelation>
	</parameter>
	<parameter type="FieldName">ev:ans</parameter>
	<parameter type=”String”>1 + 2 * 3 + inc(ev:number) + ev:string</parameter>
</filter>