Concatenate an output value from conditionalmap
Hello everyone !
I've made a parser Flex syslog subagent,
In this Flex, I put the following StringConstant :
And I’m making it more readable :
conditionalmap.count=1 conditionalmap.field=event.deviceCustomString5 conditionalmap.mappings.count=2 conditionalmap.mappings.values=46 conditionalmap.mappings.event.categoryOutcome=__stringConstant("Log Out") conditionalmap.mappings.values=45 conditionalmap.mappings.event.categoryOutcome=__stringConstant("Log In")
It works, but I’m now trying to use this String to put it in the Name field.
event.name=__concatenate(categoryOutcome,” : “,__simpleMap(Eventmod,"0=No modifier for this event","1=Ok, the event passed permission checking","2=Warning, the event failed permission checking"))
The objective is to put in the "Name" Field something like : “Log Out : Ok, the event passed permission checking”
But it seems I can’t collect values from categoryOutcome. I only get “ : Ok, the event passed permission checking” How can I use the categoryOutcome output to put it in my “Name” field ?
Thank you for the help
No idea, but possibly the conditional map is being evaluated last (or at the very least "later") so those values do not yet exist for the 'name' mapping...? If so, I bet an actual map file would work (since they operate after the parser). Check out parser like expressions in map files in the flex guide.
Yes, maybe you're right. It's just too bad there's so little documentation on a professional product. We come to assume things...
Too bad, I'm dropping this optimization since I don't know how to use map files to do this job.
Try this, hopefully it'll work, or at least get you close.
1. Map "Eventmod" token to flexString1 (or any field of your choosing, but be sure to update the below w/ the new field).
2. Input the following text into $CONN_HOME/current/user/agent/map/map.0.properties
"__concatenate(categoryOutcome,"" : "",__simpleMap(flexString1,""0=No modifier for this event"",""1=Ok, the event passed permission checking"",""2=Warning, the event failed permission checking""))"
The only potential issue is that simplemap... Usually you look up against a token (which I highly doubt would work in a map file), so instead we'll try to look up against a field. Check for errors in the logs if this doesn't work. HTH.