On 09/02/2010 02:27 PM, Risto Vaarandi wrote:
Sergio,
in my opinion, it would be much easier to create a single line within
the reporting script, since in the general case events must be somehow
separated from each other in the context event store. Also, the 'report'
action involves an execution of a separate program which creates a lot
of opportunities for joining events into a single string. Let me provide
a simple example how this can be done:
action=report MYCONTEXT (perl -e '@events = STDIN; chomp(@events);
print join( , @events)')
The command that comes in parentheses after 'report MYCONTEXT' will
assign all lines from stdin to the Perl list @events; then the newline
is removed from the end of each line, and finally events are joined into
a single string with using the space character as a separator.
There are probably other (and perhaps even shorter) ways for achieving
the same goal.
...well, report MYCONTEXT (perl -ne 's/\n/ /g; print $_')
seems to be shorter and more efficient, since it does not involve
storing standard input into a separate list, while
report MYCONTEXT perl -l40ne print
is even better ;)
(-l40 replaces the default input record separator \n with octal 40 which
is space).
HTH,
risto
hope this helps,
risto
On 09/01/2010 05:54 PM, Sergio Ruiz wrote:
Hi all,
I would like to report events added on my context in one single line.
For example:
---
A bit more elegant solution is to reverse the order of rules 2 and 3.
And now, no continue=TakeNext is needed:
# Example C4.2.02.conf
# Rule 1: create context MY_CONTEXT
# Rule 2: report context MY_CONTEXT
# Rule 3: Add to context MY_CONTEXT
# Third rule reports context
#
# Pattern 'CreateMe' creates the action
type=Single
ptype=RegExp
pattern=CreateMe
desc=$0
action=create MY_CONTEXT
# Pattern 'ReportMe' executes the report action
type=Single
ptype=RegExp
pattern=ReportMe
context=MY_CONTEXT
desc=$0
action=report MY_CONTEXT /bin/cat
# Anything else gets added to context 'MY_CONTEXT'
type=Single
ptype=RegExp
pattern=(.*)
desc=$0
action=add MY_CONTEXT $0
Without the informative debug statements the output is:
j...@jpb-lt:~/SEC-examples$perl sec.pl -conf=C4.2.02.conf -input=-
-debug=4
Simple Event Correlator version 2.1.11
Reading configuration from C4.2.02.conf
*CreateMe*
*line one*
*line two*
*ReportMe*
line one
line two
Is it posible to get this Output?
*CreateMe*
*line one*
*line two*
*ReportMe*
line one line two
Thx in advance,
--
*Sergio Ruiz Mulas*
/ /
Salvo que se indique lo contrario, esta información es CONFIDENCIAL y
contiene datos de carácter personal que han de ser tratados conforme a
la legislación vigente en materia de protección de datos. Si usted no es
destinatario original de este mensaje, le comunicamos que no está
autorizado a revisar, reenviar, distribuir, copiar o imprimir la
información en él contenida y le rogamos que proceda a borrarlo de sus
sistemas.
Unless contrary indicated, this information is CONFIDENTIAL and contains
personal data that shall be processed according to personal data
protection law in force. If you are not the named addressee of this
message you are hereby notified that any review, dissemination,
distribution, copying or printing of this message is strictly prohibited
and we urge you to delete it from your Systems.
Antes de imprimir este mensaje valora si verdaderamente es necesario. De
esta forma contribuimos a la preservación del Medio Ambiente.
--
This SF.net Dev2Dev email is sponsored by:
Show off your parallel programming skills.
Enter the Intel(R) Threading Challenge 2010.
http://p.sf.net/sfu/intel-thread-sfd
___
Simple-evcorr-users mailing list
Simple-evcorr-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
--
This SF.net Dev2Dev email is sponsored by:
Show off your parallel programming skills.
Enter the Intel(R) Threading Challenge 2010.
http://p.sf.net/sfu/intel-thread-sfd
___
Simple-evcorr-users mailing list
Simple-evcorr-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
