hi Dusan, the post you are referring to originates from 2012 when the most recent sec version was 2.6.2. This version didn't indeed have support for looping in action lists. While 2.7.X versions do not have a specific action for regular expression based filtering of context names, it can be done in a straightforward way with 'lcall' action. For example:
lcall %names -> ( sub { grep(/^MY/, keys %main::context_list) } ) The above action takes advantage of the fact that context names act as keys in the %main::context_list hash, and uses a simple grep(/regex/, ...) filter for extracting all relevant names. I would argue that using 'lcall' instead of a 'findcont' action allows for more generic filtering, since you can define more complex conditions inside a Perl code snippet that just one regular expression. Also, here is an example how to use the above action for actual deletion: type=single ptype=regexp pattern=create (\S+) desc=set up context $1 action=create $1 type=single ptype=substr pattern=delete desc=find context names action=lcall %names -> ( sub { grep(/^MY/, keys %main::context_list) } ); \ fill BUFFER %names; getsize %n BUFFER; \ while %n ( shift BUFFER %context; delete %context; getsize %n BUFFER) If you start up sec with this rule and feed in events create AAA create BBB create CCC create MYCONT1 create MYCONT2 then five contexts AAA, BBB, CCC, MYCONT1 and MYCONT2 are created by the first rule. If you feed a line to sec that contains the string "delete", the second rule uses regular expression ^MY to find out contexts with prefix "MY" and deletes them. In the case of above five contexts, MYCONT1 and MYCONT2 get deleted. In order to accomplish deletion in the while-loop, context names are pushed into the event store of the context called BUFFER, and the body of the loop gets executed until all context names have been consumed for BUFFER. During each iteration, the first name from the event store of BUFFER is taken away with the 'shift' action, deleting the context with that name. After that, the number of remaining names is established with the 'getsize' action, and if getsize returns 0, the loop terminates. Hope this helps, risto 2017-04-20 12:51 GMT+03:00 Dusan Sovic <dusan.so...@hotmail.sk>: > Dear mailing list users, > > I would like to know if there is a possibility or plan to support regular > expression matching against context names. > In my case sometimes it can be useful to have option to delete all contexts > matching given regexp pattern like 'delete device01.com.*'. > Contexts what I creating contains device FQDN and additional information so > for one device I can have one or more contexts created 1:N. > > Example: > Context Name: > device01.com|H3C-LAGG-LAGG_INACTIVE_PARTNER|Ten-GigabitEthernet1/0/7-BAGG57 > Context Name: > device01.com|H3C-LAGG-LAGG_INACTIVE_PARTNER|Ten-GigabitEthernet1/0/8-BAGG58 > > In the past this topic was discussed in this post: > https://sourceforge.net/p/simple-evcorr/mailman/message/30011331/ and Risto > proposed to create "action 'findcont %o regexp', that would allow for > creating repeated actions over data in variable %o." > > Thanks and Best Regards, > Dusan > > ------------------------------------------------------------------------------ > Check out the vibrant tech community on one of the world's most > engaging tech sites, Slashdot.org! http://sdm.link/slashdot > _______________________________________________ > Simple-evcorr-users mailing list > Simple-evcorr-users@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot _______________________________________________ Simple-evcorr-users mailing list Simple-evcorr-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users