Regular Expression Group Filter

Definition

Description

If event matches Condition break apart FieldName using regular expression description String and assign values matched into FieldNameList.

 

 

Comments

If FieldName is missing, blank or invalid, do nothing.
If regular expression String is missing, blank or invalid, do nothing.
If FieldNameList is missing or blank, do nothing.

Event before:

<event>
	<ev:host>host1></ev:host>
	<ev:app>app1</ev:app>
	<ev:msg>aaadiamonds11perls22gold</ev:msg>
</event>
 
Event after: 
<event>
	<ev:host>host1></ev:host>
	<ev:app>app1</ev:app>
	<ev:msg>aaadiamonds11perls22gold</ev:msg>
	<ev:group1>diamonds</ev:group1>
	<ev:group2>perls</ev:group2>
</event>
 
For more information on Regular Expressions, please see Sun's regular expression patterns summary.

 

Example

<filter objectId="case1" type="RegularExpressionGroupFilter">
	<parameter autoSetDescription="false" comments="Add comments for Condition..." description="app=app1" type="Condition">
		<negatePrimaryCondition>false</negatePrimaryCondition>
		<conditionRelation>All</conditionRelation>
		<conditionSpec>
			<negate>false</negate>
			<fieldName>ev:app</fieldName>
			<operator>eq</operator>
			<valueType>string</valueType>
			<value>app1</value>
		</conditionSpec>
	</parameter>
	<parameter type="FieldName">ev:msg</parameter>
	<parameter type="String">aaa(.*)11(.*)22.*</parameter>
	<parameter type="FieldNameList">
		<fieldName>ev:group1</fieldName>
		<fieldName>ev:group2</fieldName>
	</parameter>
</filter>