On 09/02/2010 02:27 PM, Risto Vaarandi wrote:
> Sergio,
>
> in my opinion, it would be much easier to create a single line within
> the reporting script, since in the general case events must be somehow
> separated from each other in the context event store. Also, the 'report'
> action involves an execution of a separate program which creates a lot
> of opportunities for joining events into a single string. Let me provide
> a simple example how this can be done:
>
> action=report MYCONTEXT (perl -e '@events = <STDIN>; chomp(@events);
> print join(" ", @events)')
>
> The command that comes in parentheses after 'report MYCONTEXT' will
> assign all lines from stdin to the Perl list @events; then the newline
> is removed from the end of each line, and finally events are joined into
> a single string with using the space character as a separator.
> There are probably other (and perhaps even shorter) ways for achieving
> the same goal....well, report MYCONTEXT (perl -ne 's/\n/ /g; print $_') seems to be shorter and more efficient, since it does not involve storing standard input into a separate list, while report MYCONTEXT perl -l40ne print is even better ;) (-l40 replaces the default input record separator \n with octal 40 which is space). HTH, risto > hope this helps, > risto > > On 09/01/2010 05:54 PM, Sergio Ruiz wrote: >> Hi all, >> >> I would like to report events added on my context in one single line. >> >> For example: >> >> ------------------------------- >> >> A bit more elegant solution is to reverse the order of rules 2 and 3. >> And now, no continue=TakeNext is needed: >> >> # Example C4.2.02.conf >> # Rule 1: create context MY_CONTEXT >> # Rule 2: report context MY_CONTEXT >> # Rule 3: Add to context MY_CONTEXT >> # Third rule reports context >> # >> >> # Pattern 'CreateMe' creates the action >> type=Single >> ptype=RegExp >> pattern=CreateMe >> desc=$0 >> action=create MY_CONTEXT >> >> # Pattern 'ReportMe' executes the report action >> type=Single >> ptype=RegExp >> pattern=ReportMe >> context=MY_CONTEXT >> desc=$0 >> action=report MY_CONTEXT /bin/cat >> >> # Anything else gets added to context 'MY_CONTEXT' >> type=Single >> ptype=RegExp >> pattern=(.*) >> desc=$0 >> action=add MY_CONTEXT $0 >> >> Without the informative debug statements the output is: >> >> j...@jpb-lt:~/SEC-examples$perl sec.pl -conf=C4.2.02.conf -input=- >> -debug=4 >> Simple Event Correlator version 2.1.11 >> Reading configuration from C4.2.02.conf >> *CreateMe* >> *line one* >> *line two* >> *ReportMe* >> line one >> line two >> ------------------------ >> >> Is it posible to get this Output? >> >> >> *CreateMe* >> *line one* >> *line two* >> *ReportMe* >> line one line two >> >> Thx in advance, >> >> >> >> -- >> >> *Sergio Ruiz Mulas* >> / / >> >> Salvo que se indique lo contrario, esta información es CONFIDENCIAL y >> contiene datos de carácter personal que han de ser tratados conforme a >> la legislación vigente en materia de protección de datos. Si usted no es >> destinatario original de este mensaje, le comunicamos que no está >> autorizado a revisar, reenviar, distribuir, copiar o imprimir la >> información en él contenida y le rogamos que proceda a borrarlo de sus >> sistemas. >> >> Unless contrary indicated, this information is CONFIDENTIAL and contains >> personal data that shall be processed according to personal data >> protection law in force. If you are not the named addressee of this >> message you are hereby notified that any review, dissemination, >> distribution, copying or printing of this message is strictly prohibited >> and we urge you to delete it from your Systems. >> >> Antes de imprimir este mensaje valora si verdaderamente es necesario. De >> esta forma contribuimos a la preservación del Medio Ambiente. >> >> >> >> ------------------------------------------------------------------------------ >> >> This SF.net Dev2Dev email is sponsored by: >> >> Show off your parallel programming skills. >> Enter the Intel(R) Threading Challenge 2010. >> http://p.sf.net/sfu/intel-thread-sfd >> >> >> >> _______________________________________________ >> Simple-evcorr-users mailing list >> Simple-evcorr-users@lists.sourceforge.net >> https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users > ------------------------------------------------------------------------------ This SF.net Dev2Dev email is sponsored by: Show off your parallel programming skills. Enter the Intel(R) Threading Challenge 2010. http://p.sf.net/sfu/intel-thread-sfd _______________________________________________ Simple-evcorr-users mailing list Simple-evcorr-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
