Break Event Into Multiple Events Filter

Definition

Description

If event matches Condition break FieldName into multiple events using Delimiter.

Comments

If FieldName, or Delimiter is missing, blank or invalid, do nothing.

For each unique delimited string in FieldName create a copy of the whole event and leave only the single delimited string in the original FieldName.

In the original event a new field ev:breakevent.count will be created containing the total number of new events created.

Release events in following order: old, n1, n2, n3

n1 is first string, n2 is second string, etc

\n is newline character delimiter

Example

Note: normally the Delimiter parameter is used to specify a direct string match, but if “\s” is used a consecutive sequence of whitespace characters is matched.

<filter objectId="break" type="BreakEventIntoMultipleEventsFilter">
	<parameter autoSetDescription="true" comments="Add comments for Condition..." description="Match all Events" type="Condition">
		<negatePrimaryCondition>false</negatePrimaryCondition>
		<conditionRelation>All</conditionRelation>
	</parameter>
	<parameter type="FieldName">ev:msg</parameter>
	<parameter type="Delimiter">\n</parameter>
</filter>