Action List

<parameter type="ActionLis"t>
	<action type="NewEvent"> <!— like insides of parm "NewEvent" -->
		<halPolicy>useCurrent|new</halPolicy>
		<hal> <!—only need hal if halPolicy is "new" -->
			<host>Host3</host> <!—default is current host -->
			<app>App3</app> <!—default is "EventGnosis" -->
			<log>Log3</log> <!—default is "Notifications" -->
		</hal>
		<destinationSpec> <!— need name only type is "specified"-->
			<type>insertIntoStream|specified</type>
			<name>Stack.OutputProc</name>
		</destinationSpec>
		<setEventFieldList>
			<setEventField fieldName="ev:msg2"> <!—can have 0..N of these -->
				<type>String</type> <!—insides of "Expression" parameter -->
				<formatString>this is ev:host field: %1%</formatString>
				<formatParmSpec> <!—0..N of these --> 
					<type>EventType</type>
					<name>ev:host</name>
				</formatParmSpec>
			</setEventField>
			<setEventField fieldName="ev:msg3">
				<type>String</type> <!—insides of "Expression" parameter -->
				<formatString>this is ev:app field: %1%</formatString>
				<formatParmSpec>
					<type>EventType</type>
					<name>ev:app</name>
				</formatParmSpec>
			</setEventField>
			<setEventField fieldName="ev:msg4">
				<type>String</type> <!—insides of "Expression" parameter -->
				<formatString>this is ev:log field: %1%</formatString>
				<formatParmSpec>
					<type>EventType</type>
					<name>ev:log</name>
				</formatParmSpec>
			</setEventField>
		</setEventFieldList>
	</action>
	<action type="SetEventFieldList">
		<setEventField fieldName="ev:msg2"> <!—can have 0..N of these -->
			<type>String</type> <!—insides of "Expression" parameter -->
			<formatString>this is ev:msg field: %1% with host %2</formatString>
			<formatParmSpec> <!—0..N of these, 0 is fixed format string -->
				<type>EventType</type>
				<name>ev:msg</name>
			</formatParmSpec>
			<formatParmSpec> <!—0..N of these, 0 is fixed format string -->
				<type>EventType</type>
				<name>ev:host</name>
			</formatParmSpec>
		</setEventField>
		<setEventField fieldName="ev:msg3">
			<type>String</type> <!—insides of "Expression" parameter -->
			<formatString>this is ev:app field: %1%</formatString>
			<formatParmSpec> <!—0..N of these, 0 is fixed format string -->
				<type>EventType</type>
				<name>ev:app</name>
			</formatParmSpec>
		</setEventField>
	</action>
</parameter>

default

<parameter type=”ActionList”>
</parameter> 

If halPolicy is useCurrent, the defaults for host, app, log (if they are missing) are local host name, “EventGnosis” and “Notifications”, respectively.

Is a user selection of one or more of the following actions:

•  %NewEvent%;

•  Set event %FieldName% to %Expression%.