Weight Events Filter

Definition

Description

If event matches Condition, find the first matching condition in ConditionWeightList and add its corresponding weight to a running sum.
Perform ActionList if the running sum reaches Threshold within TimeInterval.
Each condition CanCannot be counted multiple times.

 

 

Comments

The event will trigger only the first matching Condition.

If a Condition has already been matched and each Condition may only be counted once, then that Condition is no longer available for matching, but other unmatched conditions may still be matched.

Each time the Threshold count is reached during the TimeInterval , the specified action list is executed, and the counter, timer, and conditions are reset.

The TimeInterval starts when the first event arrives.

If the TimeInterval expires before the threshold is reached, the counter, timer, and conditions are reset.

If CanCannot is empty, missing or blank, default to "Can".

If ConditionWeightList is empty, missing or blank, disable the filter.

If TimeInterval is empty, missing, blank or less than or equal zero, it defaults to the length of the ECS session.

If Threshold is empty, missing, blank or less than or equal to zero, disable the filter.

 

Example

<filter objectId="Filter.WeightEvents" type="WeighEventsFilter">
	<parameter type="Condition">
		<negatePrimaryCondition>false</negatePrimaryCondition>
		<conditionRelation>Any</conditionRelation>
		<conditionSpec>        <!-changed name from "condition" -->
			<negate>false</negate>
			<fieldName>ev:host</fieldName>
			<operator>neq</operator>
			<valueType>string</valueType>
			<value>bozo</value>
		</conditionSpec>
	</parameter>
	<parameter type="ConditionWeightList">    
		<condition weight="1.3345" >   <!-0..N of these in an ordered list -->
			<negatePrimaryCondition>false</negatePrimaryCondition>
			<conditionRelation>All</conditionRelation>
			<conditionSpec>        <!-changed name from "condition" -->
				<negate>false</negate>
				<fieldName>ev:msg</fieldName>
				<operator>containsString</operator>
				<valueType>string</valueType>
				<value>delete</value>
			</conditionSpec>
		</condition>
	</parameter>	
	<parameter type="ActionList">
		<action type="SetEventFieldList">
			<setEventField fieldName="ev:msg4">
				<type>String</type>    <!-insides of "Expression" parm -->
				<formatString>this is %1% and %2%</formatString>
				<formatParmSpec>         
					<type>EventType</type>
					<name>ev:msg</name>
				</formatParmSpec>
			</setEventField>
		</action>
	</parameter>	
	<parameter type="Threshold">3.141592654</parameter>        <!-double value -->
	<parameter type="TimeInterval">
		<time>10</time>
		<units>min</units>
	</parameter>
	<parameter type="CanCannot">Can</parameter>
</filter>