Description |
If event matches Condition add FieldName to the event after FieldName and set to Expression. |
|
|
Comments |
If the first FieldName is "", don't do anything. If FieldName already exists add a new field after the existing field. If the second FieldName is blank, missing or invalid, the first FieldName new field will be added at the end of the event. |
<filter objectId="Filter.AddField" type="AddFieldFilter"> <parameter type="Condition"> <negatePrimaryCondition>false</negatePrimaryCondition> <conditionRelation>Any</conditionRelation> <conditionSpec> <negate>false</negate> <fieldName>ev:msg</fieldName> <operator>containsString</operator> <valueType>string</valueType> <value>delete</value> </conditionSpec> </parameter> <parameter type="FieldName">ev:protocol</parameter> <parameter type="FieldName">ev:msg</parameter> <parameter type="Expression"> <type>String</type> <formatString>this is %1% and %2%</formatString> <formatParmSpec> <!-0..N of these, 0 is fixed string --> <type>EventType</type> <!-many of these in the future --> <name>the name</name> </formatParmSpec> </parameter> </filter>