Sergio,
in my opinion, it would be much easier to create a single line within
the reporting script, since in the general case events must be somehow
separated from each other in the context event store. Also, the 'report'
action involves an execution of a separate program which creates a lot
of opportunities for joining events into a single string. Let me provide
a simple example how this can be done:
action=report MYCONTEXT (perl -e '@events = <STDIN>; chomp(@events);
print join(" ", @events)')
The command that comes in parentheses after 'report MYCONTEXT' will
assign all lines from stdin to the Perl list @events; then the newline
is removed from the end of each line, and finally events are joined into
a single string with using the space character as a separator.
There are probably other (and perhaps even shorter) ways for achieving
the same goal.
hope this helps,
risto
On 09/01/2010 05:54 PM, Sergio Ruiz wrote:
> Hi all,
>
> I would like to report events added on my context in one single line.
>
> For example:
>
> -------------------------------
>
> A bit more elegant solution is to reverse the order of rules 2 and 3.
> And now, no continue=TakeNext is needed:
>
> # Example C4.2.02.conf
> # Rule 1: create context MY_CONTEXT
> # Rule 2: report context MY_CONTEXT
> # Rule 3: Add to context MY_CONTEXT
> # Third rule reports context
> #
>
> # Pattern 'CreateMe' creates the action
> type=Single
> ptype=RegExp
> pattern=CreateMe
> desc=$0
> action=create MY_CONTEXT
>
> # Pattern 'ReportMe' executes the report action
> type=Single
> ptype=RegExp
> pattern=ReportMe
> context=MY_CONTEXT
> desc=$0
> action=report MY_CONTEXT /bin/cat
>
> # Anything else gets added to context 'MY_CONTEXT'
> type=Single
> ptype=RegExp
> pattern=(.*)
> desc=$0
> action=add MY_CONTEXT $0
>
> Without the informative debug statements the output is:
>
> j...@jpb-lt:~/SEC-examples$perl sec.pl -conf=C4.2.02.conf -input=- -debug=4
> Simple Event Correlator version 2.1.11
> Reading configuration from C4.2.02.conf
> *CreateMe*
> *line one*
> *line two*
> *ReportMe*
> line one
> line two
> ------------------------
>
> Is it posible to get this Output?
>
>
> *CreateMe*
> *line one*
> *line two*
> *ReportMe*
> line one line two
>
> Thx in advance,
>
>
>
> --
>
> *Sergio Ruiz Mulas*
> / /
>
> Salvo que se indique lo contrario, esta información es CONFIDENCIAL y
> contiene datos de carácter personal que han de ser tratados conforme a
> la legislación vigente en materia de protección de datos. Si usted no es
> destinatario original de este mensaje, le comunicamos que no está
> autorizado a revisar, reenviar, distribuir, copiar o imprimir la
> información en él contenida y le rogamos que proceda a borrarlo de sus
> sistemas.
>
> Unless contrary indicated, this information is CONFIDENTIAL and contains
> personal data that shall be processed according to personal data
> protection law in force. If you are not the named addressee of this
> message you are hereby notified that any review, dissemination,
> distribution, copying or printing of this message is strictly prohibited
> and we urge you to delete it from your Systems.
>
> Antes de imprimir este mensaje valora si verdaderamente es necesario. De
> esta forma contribuimos a la preservación del Medio Ambiente.
>
>
>
> ------------------------------------------------------------------------------
> This SF.net Dev2Dev email is sponsored by:
>
> Show off your parallel programming skills.
> Enter the Intel(R) Threading Challenge 2010.
> http://p.sf.net/sfu/intel-thread-sfd
>
>
>
> _______________________________________________
> Simple-evcorr-users mailing list
> Simple-evcorr-users@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
------------------------------------------------------------------------------
This SF.net Dev2Dev email is sponsored by:
Show off your parallel programming skills.
Enter the Intel(R) Threading Challenge 2010.
http://p.sf.net/sfu/intel-thread-sfd
_______________________________________________
Simple-evcorr-users mailing list
Simple-evcorr-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
