Substitute String Filter

Definition

Description

If event matches Condition substitute every occurrence of String in FieldName with String.

Comments

If FieldName or the first String is missing, blank or invalid, do nothing.

The first String is interpreted as a regular expression.

The second String is a literal character sequence which may include new line ('\n') or other special characters.

Example:
First String = "gl[ia]de"
FieldName = "ev:msg"
Second String = "-----"

Event before:
ev:msg = "This is a glade but not a glide"

Event after:
ev:msg = "This is a ----- but not a -----"

Example

<filter objectId="SubstituteString.one" type="SubstituteStringFilter">
	<parameter type="Condition">
		<negatePrimaryCondition>false</negatePrimaryCondition>
		<conditionRelation>Any</conditionRelation>
		<conditionSpec> <!—changed name from “condition” -->
			<negate>false</negate>
			<fieldName>ev:host</fieldName>
			<operator>neq</operator>
			<valueType>string</valueType>
			<value>HOST_INVALID</value>
		</conditionSpec>
	</parameter>
	<parameter type="String">host</parameter>
	<parameter type="FieldName">ev:msg</parameter>
	<parameter type="String">INVALID HOST</parameter>
</filter>