Page History

...

• set.propertyname(value) sets the named property to the static value.
  No quoting of the value is required or supported.
  The character ")" cannot be part of the value before opEvents 2.2; In 2.2 and above it may only be present if you use the explicit list format for your action statement.
• capture(propname1,propname2,...) saves the respective captures from the regex in the named properties. The captures are assigned in their order in the regular expression; if you want grouping but not capturing, use (?:....) in your regex. Note that you cannot use multiple capture statements in one THEN.
• opEvents version 2.0  introduces the new action ignore. This aborts all parsing of this input line altogether and no event is created for it.
  Normally the generic parser is expected to extract suitable information for an event from every single input line, which might not work well if your log data is coming from multiple sources or can't be suitably prefiltered.
• In opEvents version 2.2 we've added the directive directives  resolve.fwd(propname) and resolve.
  If the named property value is an IP address, then resolve() queries the DNS rev(propname).
  The resolve.fwd() directive expects the property to be a DNS name and queries the DNS for an IP address associated  with the name; the resolve.rev() directive interprets the property as an IP address and looks for a host name for it; otherwise it looks for an IP address for the property value. If the resolution is successful, the property value is replaced by the DNS data; otherwise the property is left as-is.

...