On 01/02/2012 09:47 PM, John P. Rouillard wrote: > > In message<4efc8c3c.4050...@seb.ee>, > Risto Vaarandi writes: > >> I have finished working on the new input buffering scheme which allows >> for using separate input buffers for each input source (plus a separate >> buffer for synthetic events). The old one-buffer-for-all scheme is also >> present in the code, and the work mode can be changed with --jointbuf >> and --nojointbuf options. This added functionality will make multiple >> line patterns much more useful, and would also make event rewriting more >> powerful. >> >> I've now started to think how the rewriting can actually be done. A >> separate rule is one option, but my personal preference lies with a >> special 'rewrite' or 'replace' action (an action would allow for >> rewriting from any rule type). With an action, there are several >> implementation avenues: >> >> 1) rewrite<somestring> -- if<somestring> is made up of N lines, the >> action will replace last N lines in the input buffer with<somestring>. >> >> 2) rewrite<amount> <somestring> -- <amount> specifies the number of >> lines which need rewriting. If<somestring> contains more than<amount> >> lines, only first<amount> lines are written; if<somestring> has lesser >> amount of lines, leading empty lines will be added. > > I am not sure if this is better, but you could require the use of > regexpN/substrN > to match/replace more than one line. > > type = single > ptype = regexp4 > pattern = ... > action = rewrite ,new $1 $6 %a value, > > would rewrite 4 lines in the buffer to a single line. Also I often have a > sequence > of lines whose length is unknown beforehand. I currently create a new event > from the contents of a context and put the event on the event stream. Ideally > I would like to replace all the events from the start event to the end > event with my single line event, but I don't have a count of the number of > lines. > > I'm not sure that's a solvable problem. >
I think it is possible to address this issue with rewrite <amount> <somestring> If the <amount> can be an action list variable, it is possible to find the number of lines in matched data (with 'lcall' or 'eval', for example), and assign it to the variable. There are already actions which work in this way -- for instance, 'create' action accepts a variable for the lifetime parameter, provided it evaluates to positive integer at runtime. The only thing which has to be considered is how to preserve the length of the input buffer (its size can not vary, since it is implemented as a ring buffer). I think the best is to add leading empty lines, if N lines of the buffer are overwritten with lesser amount of lines (that creates some empty lines between the overwritten event and the previous event, though). regards, risto ------------------------------------------------------------------------------ Write once. Port to many. Get the SDK and tools to simplify cross-platform app development. Create new or port existing apps to sell to consumers worldwide. Explore the Intel AppUpSM program developer opportunity. appdeveloper.intel.com/join http://p.sf.net/sfu/intel-appdev _______________________________________________ Simple-evcorr-users mailing list Simple-evcorr-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
