Add Field Filter

Definition

Description

If event matches Condition add FieldName to the event after FieldName and set to Expression.

 

 

Comments

If the first FieldName is "", don't do anything. If FieldName already exists add a new field after the existing field.

If the second FieldName is blank, missing or invalid, the first FieldName new field will be added at the end of the event.

 

Example

<filter objectId="Filter.AddField" type="AddFieldFilter">
	<parameter type="Condition">
		<negatePrimaryCondition>false</negatePrimaryCondition>
		<conditionRelation>Any</conditionRelation>
		<conditionSpec>
			<negate>false</negate>
			<fieldName>ev:msg</fieldName>
			<operator>containsString</operator>
			<valueType>string</valueType>
			<value>delete</value>
		</conditionSpec>
	</parameter>
	<parameter type="FieldName">ev:protocol</parameter>
	<parameter type="FieldName">ev:msg</parameter>
	<parameter type="Expression">
		<type>String</type>
	<formatString>this is %1% and %2%</formatString>
		<formatParmSpec>          <!-0..N of these, 0 is fixed string -->
		<type>EventType</type>  <!-many of these in the future -->
		<name>the name</name>
		</formatParmSpec>
	</parameter>
</filter>