On 17 dec 2014, 01:01, Risto Vaarandi wrote : > ...as John already mentioned in his post, you will need to set up the > 'context2' field. The 'context' field will be evaluated together with > 'pattern' only, and it will not restrict matches by 'pattern2' field.
Absolutly, I should have read it in the man. With context2 added, the ruleset just works fine. > > Interesting fact : $+{_inputsrc} displays "log/RECEPTION.log" even if > > pattern2 is matched against "log/OUTPUT.log". > > > > You are seeing this because ptype2 is set to 'substr' -- which means fast > substring search without any regular expression matching. However, for the > reasons of efficiency, SubStr patterns do not set match any variables, and > thus $+{_inputsrc} is will keep holding the value from the previous pattern > match (produced by 'pattern'). If you would change 'ptype2' field from > substr to regexp, $+{_inputsrc} would refer to "log/OUTPUT.log", since this > time 'pattern2' is a regular expression which sets $+{_inputsrc}. That just makes sense, thak you for highlighting this. > A side note -- if you set ptype2=regexp and have a regular expression > for pattern2, but want to refer to past match variables previously set > by 'pattern', you have to use the % prefix instead of $ in the 'desc2' > field. For example, the following fields > > ptype2=regexp > pattern2=receiving file list \.\.\. done > desc2=Alarm end on $+{_inputsrc} > action2=logonly > > would log "Alarm end on log/OUTPUT.log". > > On the other hand, both > > ptype2=regexp > pattern2=receiving file list \.\.\. done > desc2=Alarm end on %+{_inputsrc} > action2=logonly > > and > > ptype2=substr > pattern2=receiving file list ... done > desc2=Alarm end on $+{_inputsrc} > action2=logonly > > would log "Alarm end on log/RECEPTION.log". In short, in Pair* rules > $-prefix always refers to the most recent set of match variables, while > with %-prefix you can refer to previous set of match variables. Also, the > existence of $-prefixed and %-prefixed match variables depends on pattern > type(s) -- for example, if ptype=substr and ptype2=substr, neither $ nor % > match variables exist, since substr-patterns never set any match variables. Valuable information ! Thank you. > hope this helps, It really does. Thanks again. ------------------------------------------------------------------------------ Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server from Actuate! Instantly Supercharge Your Business Reports and Dashboards with Interactivity, Sharing, Native Excel Exports, App Integration & more Get technology previously reserved for billion-dollar corporations, FREE http://pubads.g.doubleclick.net/gampad/clk?id=164703151&iu=/4140/ostg.clktrk _______________________________________________ Simple-evcorr-users mailing list Simple-evcorr-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users