...finally, you could also take advantage of the pattern match cache, and
include additional variable checks in context expressions, as described in
the example in official documentation:
http://simple-evcorr.sourceforge.net/man.html#lbBA
The above example includes one rule for parsing iptables events, and more
specific rules which consume events from the parsing rule.
In the current version, there is no action for passing a reference to the
whole variable map into a perl function, but this kind of action (similar
to lcall, but with different parameters) is probably fairly easy to
implement.
And of course, as a workaround it is possible to employ a custom perl hash
for storing all match variables. This hash can then be processed in
perlfunc patterns, context expressions and lcall actions.
kind regards,
risto
2013/9/28 Mark D. Nagel <[email protected]>
> On 9/27/2013 8:37 PM, David Lang wrote:
> >
> > actually, it occures to me that you can just use the hash that the
> > json parse creates, the thing that gets passed to flatten.
> >
> > In fact, the more I think about it, the less it seems to be the right
> > thing to use flatten and cache.
> >
> > Instead it seems like the right thing to do is to have one rule parse
> > the data and create the hash representation of it, and then just use
> > perlfunc patterns in the rest of the rules and have them check the
> > variables created by the first rule.
> >
>
> You are absolutely right. Kept trying to use cache since it seemed like
> the right way to go, but this is far simpler.
>
> Thanks,
> Mark
>
> --
> Mark D. Nagel, CCIE #3177 <[email protected]>
> Principal Consultant, Willing Minds LLC (http://www.willingminds.com)
> cell: 949-279-5817, desk: 714-495-4001, fax: 714-646-8277
>
> ** For faster support response time, please
> ** email [email protected] or call 714-495-4000
>
>
>
> ------------------------------------------------------------------------------
> October Webinars: Code for Performance
> Free Intel webinars can help you accelerate application performance.
> Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most
> from
> the latest Intel processors and coprocessors. See abstracts and register >
> http://pubads.g.doubleclick.net/gampad/clk?id=60133471&iu=/4140/ostg.clktrk
> _______________________________________________
> Simple-evcorr-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
>
------------------------------------------------------------------------------
October Webinars: Code for Performance
Free Intel webinars can help you accelerate application performance.
Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from
the latest Intel processors and coprocessors. See abstracts and register >
http://pubads.g.doubleclick.net/gampad/clk?id=60133471&iu=/4140/ostg.clktrk
_______________________________________________
Simple-evcorr-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
