Jonathan,
you can accomplish the task with the following two single rules:
type=Single
ptype=regexp
pattern=var1=(\S+) var2=\S+ var3=\S+
context=!EVENT_WITH_VARS_OBSERVED
desc=var1 $1 has been observed
action=create EVENT_WITH_VARS_OBSERVED; \
alias EVENT_WITH_VARS_OBSERVED VAR1_$1_OBSERVED
type=Single
ptype=regexp
pattern=var1=(\S+) var2=\S+ var3=\S+
context=!VAR1_$1_OBSERVED
desc=var1 $1 has been observed
action=write - an event with a different var1 value has been observed; \
delete EVENT_WITH_VARS_OBSERVED
The first event with var1, var2 and var3 will create a context
EVENT_WITH_VARS_OBSERVED with an alias name which holds the value of var1.
After the context EVENT_WITH_VARS_OBSERVED has been created, further events
are passed to the second rule which checks for the presence of the alias
name. If the alias name for var1 value is missing, the second rule matches
and writes a message to standard output.
Note that the order of the rules is important, and if you want to change
this, the 'context' field of the second rule should be written as
context=EVENT_WITH_VARS_OBSERVED && !VAR1_$1_OBSERVED
You can rewrite the above two rules into a one Pair rule, but I would
personally prefer to have two Single rules, since it's a bit clearer. Also,
event correlation logic is implemented with contexts, so the rule having
Pair instead of Single rules doesn't really matter here.
kind regards,
risto
2015-04-14 11:05 GMT+03:00 Jonathan Snowe <jonathan.sn...@gmail.com>:
> Hello guys,
>
> I'd like some help on a little problem have to solve.
> Here's my situation:
> I have multiple sources, receiving similar events. SEC is configured to
> listen to these inputs.
>
> Events are of this type:
> var1="" var2="" var3=""
>
> What I want to do is, trigger an action if a first event appears with
> "whatever the value of these fields" (large regex), and a second event
> appears with "var1 different from the FIRST var1".
>
> I tried to configure a Pair rule, but the problem is that my two events
> trigger the large pattern1 regex and never trigger the pattern2.
>
> The objective is then to write somewhere vars from the event 1 and event 2.
>
> Thank you,
>
> --
> *Jon.*
>
>
> ------------------------------------------------------------------------------
> BPM Camp - Free Virtual Workshop May 6th at 10am PDT/1PM EDT
> Develop your own process in accordance with the BPMN 2 standard
> Learn Process modeling best practices with Bonita BPM through live
> exercises
> http://www.bonitasoft.com/be-part-of-it/events/bpm-camp-virtual-
> event?utm_
> source=Sourceforge_BPM_Camp_5_6_15&utm_medium=email&utm_campaign=VA_SF
> _______________________________________________
> Simple-evcorr-users mailing list
> Simple-evcorr-users@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
>
>
------------------------------------------------------------------------------
BPM Camp - Free Virtual Workshop May 6th at 10am PDT/1PM EDT
Develop your own process in accordance with the BPMN 2 standard
Learn Process modeling best practices with Bonita BPM through live exercises
http://www.bonitasoft.com/be-part-of-it/events/bpm-camp-virtual- event?utm_
source=Sourceforge_BPM_Camp_5_6_15&utm_medium=email&utm_campaign=VA_SF
_______________________________________________
Simple-evcorr-users mailing list
Simple-evcorr-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
