Condition

See table below for all possible combinations of operators available for specific types.

<parameter type="Condition">
	<negatePrimaryCondition>false</negatePrimaryCondition>
	<conditionRelation>All</conditionRelation>
	<conditionSpec> <!0 or more of these -->
		<negate>false</negate>
		<fieldName>ev:msg</fieldName>
		<operator>containsString</operator>
		<valueType>string</valueType>
		<value>host</value>
	</conditionSpec>
</parameter> 

default

<parameter type="Condition">
	<negatePrimaryCondition>false</negatePrimaryCondition>
	<conditionRelation>All</conditionRelation>
</parameter>

default <conditionSpec>

<conditionSpec> <!0 or more of these -->
	<negate>false</negate>
	<fieldName>ev:msg</fieldName>
	<operator>containsString</operator>
	<valueType>string</valueType>
	<value>value</value>
</conditionSpec>

Details

A condition consists of the following elements:

EvField is any valid fieldname in an event or the word "Any", which attempts to test expression against every field in event, and returns TRUE if at least one expression evaluates to TRUE. If the fieldname does not exist in the event the comparison returns FALSE, which may be negated by the ConditionSpec negate flag.

Valid Valuetype for operators:
string and number:   equal, not equal, greater than, less than, less than or equal, greater than or equal, exists, is empty.
STRING ONLY: contains, isContainedinString, matchesRegularExpression, inList.

For more information on Regular Expressions, please see Sun's regular expression patterns summary.

 

Operator Table

Condition Phrase

<negate>

<operator>

<valueType>

numerically equal

false

eq

number

equal to string

false

eq

string

equal to case insensitive string

false

eq

stringIgnoreCase

 

 

 

 

numerically not equal

false

neq

number

not equal to string

false

neq

string

not equal to case insensitive string

false

neq

stringIgnoreCase

 

 

 

 

numerically greater than

false

gt

number

ASCII greater than

false

gt

string

ASCII case insensitive greater than

false

gt

stringIgnoreCase

 

 

 

 

numerically greater than or equal to

false

geq

number

ASCII greater than or equal to

false

geq

string

ASCII case insensitive greater than or equal to

false

geq

stringIgnoreCase

 

 

 

 

numerically less than

false

lt

number

ASCII less than

false

lt

string

ASCII case insensitive less than

false

lt

stringIgnoreCase

 

 

 

 

numerically less than or equal to

false

leq

number

ASCII less than or equal to

false

leq

string

ASCII case insensitive less than or equal to

false

leq

stringIgnoreCase

 

 

 

 

contains string

false

containsString

string

contains string case insensitive

false

containsString

stringIgnoreCase

does not contain string

true

containsString

string

does not contain string case insensitive string

true

containsString

stringIgnoreCase

 

 

 

 

is substring of

false

isContainedInString

string

is case insensitive substring of

false

isContainedInString

stringIgnoreCase

is not substring of

true

isContainedInString

string

is not case insensitive substring of

true

isContainedInString

stringIgnoreCase

 

 

 

 

matches regular expression

false

matchesRegExp

string

does not match regular expression

true

matchesRegExp

stringIgnoreCase

 

 

 

 

matches one of value list

false

isInList

string

matches one of value case insensitive list

false

isInList

stringIgnoreCase

does not match one of value list

true

isInList

string

does not match one of value case insensitive list

true

isInList

stringIgnoreCase

 

 

 

 

exists

false

exists

n/a

does not exist

true

exists

n/a

 

 

 

 

is empty

false

isEmpty

n/a

is not empty

true

isEmpty

n/a


Special Cases

If there is more than one fieldName in the event, only the first will be considered.

Number

String or StringIgnoreCase