<parameter type="ActionLis"t> <action type="NewEvent"> <!— like insides of parm "NewEvent" --> <halPolicy>useCurrent|new</halPolicy> <hal> <!—only need hal if halPolicy is "new" --> <host>Host3</host> <!—default is current host --> <app>App3</app> <!—default is "EventGnosis" --> <log>Log3</log> <!—default is "Notifications" --> </hal> <destinationSpec> <!— need name only type is "specified"--> <type>insertIntoStream|specified</type> <name>Stack.OutputProc</name> </destinationSpec> <setEventFieldList> <setEventField fieldName="ev:msg2"> <!—can have 0..N of these --> <type>String</type> <!—insides of "Expression" parameter --> <formatString>this is ev:host field: %1%</formatString> <formatParmSpec> <!—0..N of these --> <type>EventType</type> <name>ev:host</name> </formatParmSpec> </setEventField> <setEventField fieldName="ev:msg3"> <type>String</type> <!—insides of "Expression" parameter --> <formatString>this is ev:app field: %1%</formatString> <formatParmSpec> <type>EventType</type> <name>ev:app</name> </formatParmSpec> </setEventField> <setEventField fieldName="ev:msg4"> <type>String</type> <!—insides of "Expression" parameter --> <formatString>this is ev:log field: %1%</formatString> <formatParmSpec> <type>EventType</type> <name>ev:log</name> </formatParmSpec> </setEventField> </setEventFieldList> </action> <action type="SetEventFieldList"> <setEventField fieldName="ev:msg2"> <!—can have 0..N of these --> <type>String</type> <!—insides of "Expression" parameter --> <formatString>this is ev:msg field: %1% with host %2</formatString> <formatParmSpec> <!—0..N of these, 0 is fixed format string --> <type>EventType</type> <name>ev:msg</name> </formatParmSpec> <formatParmSpec> <!—0..N of these, 0 is fixed format string --> <type>EventType</type> <name>ev:host</name> </formatParmSpec> </setEventField> <setEventField fieldName="ev:msg3"> <type>String</type> <!—insides of "Expression" parameter --> <formatString>this is ev:app field: %1%</formatString> <formatParmSpec> <!—0..N of these, 0 is fixed format string --> <type>EventType</type> <name>ev:app</name> </formatParmSpec> </setEventField> </action> </parameter>
<parameter type=”ActionList”> </parameter>
If halPolicy is useCurrent, the defaults for host, app, log (if they are missing) are local host name, “EventGnosis” and “Notifications”, respectively.
Is a user selection of one or more of the following actions:
• %NewEvent%;
• Set event %FieldName% to %Expression%.