On 12/13/2011 4:20 AM, Risto Vaarandi wrote: > hi all, > some months ago, we had a discussion on rewriting input events: > > http://sourceforge.net/mailarchive/forum.php?thread_name=4E066179.3010304%40willingminds.com&forum_name=simple-evcorr-users > > > Would a similar feature be of interest to the end users? :) > I was thinking about attacking the problem in a more general way, but > couldn' find a truly elegant solution :(
Obviously, I'd still like that :). We are in the middle of planning a change of Windows Event Log export tools, and of course the format is different. Instead of rewriting all our rules, we could instead transform the new input to look like the old input. Of course, with the new cached pattern tools, we could redo our rules once to extract the fields we need and then change the extraction rules instead to match the new input, using the cached fields in the revised ruleset. Regardless, being able to transform input in place with no other changes in context, etc. would be a handy tool to have available. Thanks, Mark -- Mark D. Nagel, CCIE #3177 <[email protected]> Principal Consultant, Willing Minds LLC (http://www.willingminds.com) cell: 949-279-5817, desk: 714-495-4001, fax: 949-623-9854 ** For faster support response time, please ** email [email protected] or call 714-495-4000 ------------------------------------------------------------------------------ Systems Optimization Self Assessment Improve efficiency and utilization of IT resources. Drive out cost and improve service delivery. Take 5 minutes to use this Systems Optimization Self Assessment. http://www.accelacomm.com/jaw/sdnl/114/51450054/ _______________________________________________ Simple-evcorr-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
