2015-10-06 23:12 GMT+03:00 David Lang <da...@lang.hm>: > On Tue, 6 Oct 2015, Bond Masuda wrote: > > > Let's say I have messages like: > > > > msg=A > > msg=B > > ... > > > > > > and my rule is: > > > > type=Single > > ptype=regexp > > pattern=^msg=(.*)$ > > action= assign %msg $1; \ > > create EVENT_%msg 30 ( logonly %msg expired ) > > > > > > Does the action list for when the context EVENT_%msg expires, get saved > > somewhere when the create action happens? Or, does that get evaluated > > when the context expires? > > > > e.g., if msg=A and msg=B are less than 30 seconds apart, when EVENT_A > > expires, will I get "A expired" or "B expired" in my log message? > > > > Is the scope of action variables like %msg in the above example global? > > If one rule sets %msg, can another rule then access that value in %msg? > > Or are they all locally scoped and disappear once the rule is done > > processing? > > the variables are local to the rule, but you can use varmap to save them > from > one rule and access them from others (this is designed to avoid needing to > do > the parsing multiple times) >
David, you probably meant match variables, not action list variables? risto > > David Lang > > > ------------------------------------------------------------------------------ > _______________________________________________ > Simple-evcorr-users mailing list > Simple-evcorr-users@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users >
------------------------------------------------------------------------------
_______________________________________________ Simple-evcorr-users mailing list Simple-evcorr-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
