package com.eventgnosis.filters; /************************************************************************ * * Confidential and Proprietary Information of EventGnosis, Inc. * * Copyright 2002-2007 by EventGnosis, Inc. - All Rights Reserved. * * Affixing of the above copyright notice does not in itself constitute * publication or intended publication of these confidential materials. * ************************************************************************ * * Name: CountUniqueEventsFilter.java * * Description: count unique events based on a fieldname. * * If event matches %Condition%, for each unique value of %FieldName%, * perform %ActionList% if count reaches %Threshold% within %TimeInterval%. * * NOTE: * * Bugs: * Notes: None * ************************************************************************ * **/ import java.util.ArrayList; import java.util.HashMap; import java.util.Iterator; import com.eventgnosis.config.ConfigurationManager; import com.eventgnosis.config.EmmlConfig; import com.eventgnosis.system.SystemObject; import com.eventgnosis.types.Event; import com.eventgnosis.types.XmlRep; import com.eventgnosis.util.Log; import com.eventgnosis.util.Util; public final class CountUniqueEventsFilter extends FilterBase { private HashMap<String, CountUniqueRec> uniqueMap = new HashMap<String, CountUniqueRec>(); // holds countRecs by fieldName value keep track of prior event private String idFieldName = null; // the unique fieldName to catalog private long threshold = 0; // if count exceeds this # w/in time interval, set field to expression private TimeInterval timeInterval = null; // look at count over this time interval from start of event occurrence private ActionList actionList = null; // perform this list if threshold exceeded w/in time interval for each event public void setVars( Log log, String name, SystemObject myMgr, ConfigurationManager configMgr, EmmlConfig eCfg ) { super.setVars( log, name, myMgr, configMgr, eCfg ); if ( eCfg != null ) { setCondition( eCfg ); // build selection list from filter's XML def // get field name on which to ID uniqueness. Set to "" if not specified. if ( ( idFieldName = (String) eCfg.getParmObject( "FieldName", 0 ) ) == null ) { idFieldName = ""; // default unique ID if missing } double dThreshold = Util.strToDouble( (String) eCfg.getParmObject( "Threshold", 0 ) ); threshold = Util.isDoubleError( dThreshold ) ? 0 : (long) ( dThreshold + 0.5 ); // round up for counting events if ( ( ( timeInterval = (TimeInterval) eCfg.getParmObject( "TimeInterval", 0 ) ) == null ) || ( timeInterval.getMsecs() <= 0 ) ) { timeInterval = TimeInterval.getDefault(); } setExpirationTime( timeInterval.getMsecs() ); // cleanup time if ( ( actionList = (ActionList) eCfg.getParmObject( "ActionList", 0 ) ) == null ) { actionList = ActionList.getDefault(); } } } // look for events that match condition. Insert into count map by fieldName id value // and if count for that id has exceeded the threshold, write an expression into // the specified new event field. public ArrayList processEvent( Event ev ) { ArrayList evRoutingList = super.processEvent( ev ); // get stdout first (is mandatory) // see if current event matches selection criteria & not disabled if ( ( ev != null ) && ( threshold > 0 ) && ( matchCondition( ev ) ) ){ XmlRep xr = ev.getXml(); // get the fieldName=value representation from the current event String currId = ( ( idFieldName.length() > 0 ) && ( xr != null ) && ( xr.getPropertyValue( idFieldName ) != null ) ) ? xr.getPropertyValue( idFieldName ) : "";// use currId of "" if any problems with original id or getting value CountUniqueRec countRec = (CountUniqueRec) uniqueMap.get( currId ); // lookup currId state if ( countRec == null ) { // if null doesn't exist yet countRec = new CountUniqueRec( timeInterval.getMsecs() ); uniqueMap.put( currId, countRec ); } if ( countRec.isExpired() ) { // guaranteed to exist now, see if it's expired countRec.reset(); } countRec.incrementCount(); // unconditionally increment if ( countRec.getCount() >= threshold ) { // if reached threshold w/in TimeInterval String errors = actionList.perform( ev, evRoutingList, this ); // perform actions on the event and possibly create new events to be routed if ( errors != null ) { getLog().err( getName() + " error performing actionList!" ); } countRec.reset(); // reset interval } } deleteExpired( uniqueMap ); // cleanup out expired entries return ( evRoutingList ); // Return one or more events and their destinations (e.g. original event going to next filter in the stack, and zero or more action events) } //build XML pertaining to configuration for use and display in ORION Debugger public String getConfigXml() { String xml = super.getConfigXml(); // id info xml += ( getCondition() == null ) ? "" : getCondition().getConfigXml(); xml += Util.toEmmlParmXml( "FieldName", idFieldName ); xml += Util.toEmmlParmXml( "Threshold", Long.toString( threshold ) ); xml += Util.toEmmlParmXml( "TimeInterval", timeInterval.getConfigXml() ); xml += Util.toEmmlParmXml( "ActionList", actionList.getConfigXml() ); return ( Util.toXml( "filter", xml ) ); } //build XML pertaining to runtime for use and display in ORION Debugger public String getRuntimeXml() { String xml = super.getRuntimeXml(); // id info if ( uniqueMap != null ) { Iterator iter = uniqueMap.keySet().iterator(); while ( iter.hasNext() ) { String key = (String) iter.next(); CountUniqueRec cuRec = (CountUniqueRec) uniqueMap.get( key ); xml += Util.toXml( "countRec", ( Util.toXml( "id", key ) + cuRec == null ? "" : cuRec.getRuntimeXml() ) ); } } return ( Util.toXml( "filter", xml ) ); } }