Re: [Simple-evcorr-users] Data normalization

2011-12-13 Thread Risto Vaarandi
On 12/12/2011 04:01 PM, Alberto Cortón wrote: Hi, I would like to know if any of you have used SEC for normalizing log data. My first approach to this was to generate normalized events like this: action = event

Re: [Simple-evcorr-users] Data normalization

2011-12-13 Thread Risto Vaarandi
On 12/12/2011 04:01 PM, Alberto Cortón wrote: Hi, I would like to know if any of you have used SEC for normalizing log data. My first approach to this was to generate normalized events like this: action = event

[Simple-evcorr-users] rewriting input

2011-12-13 Thread Risto Vaarandi
hi all, some months ago, we had a discussion on rewriting input events: http://sourceforge.net/mailarchive/forum.php?thread_name=4E066179.3010304%40willingminds.comforum_name=simple-evcorr-users Would a similar feature be of interest to the end users? :) I was thinking about attacking the

Re: [Simple-evcorr-users] Data normalization

2011-12-13 Thread Alberto Cortón
Thank you very much, Risto. This is exactly what I was looking for. Also thank you David for pointing out liblognorm. I didn't know about it and it's pretty interesting. Best regards, On Tue, 13 Dec 2011 14:05:28 +0200 Risto Vaarandi risto.vaara...@seb.ee wrote: On 12/12/2011 04:01 PM,

Re: [Simple-evcorr-users] Data normalization

2011-12-13 Thread david
On Tue, 13 Dec 2011, Risto Vaarandi wrote: ...to add another idea -- if you want to run a very fast normalization on logs with multi-line events, you could also take advantage of the LogPP (Log PreProcessor) utility at http://logpp.sourceforge.net. I wrote it some years ago for fast

Re: [Simple-evcorr-users] rewriting input

2011-12-13 Thread Mark D. Nagel
On 12/13/2011 4:20 AM, Risto Vaarandi wrote: hi all, some months ago, we had a discussion on rewriting input events: http://sourceforge.net/mailarchive/forum.php?thread_name=4E066179.3010304%40willingminds.comforum_name=simple-evcorr-users Would a similar feature be of interest to the end

Re: [Simple-evcorr-users] Data normalization

2011-12-13 Thread Risto Vaarandi
2011/12/13 da...@lang.hm: On Tue, 13 Dec 2011, Risto Vaarandi wrote: ...to add another idea -- if you want to run a very fast normalization on logs with multi-line events, you could also take advantage of the LogPP (Log PreProcessor) utility at http://logpp.sourceforge.net. I wrote it some

Re: [Simple-evcorr-users] rewriting input

2011-12-13 Thread Alberto Cortón
Of course I would be interested too :D Using varmaps is somewhat limited. For instance, AFAIK you can't assign a variable the string 'deny' regardless the value of the captured group is 'Deny', 'denied', 'DROP', etc Regards, On Tue, 13 Dec 2011 10:26:36 -0800 Mark D. Nagel