Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: added docs for copy_present

...

  1. If no copy_firstcopy_lastcopy_highestcopy_present or copy_groupby directives are present, then a backwards-compatible directive 'copy_last => [ qr// ]'copy_last => [ qr// ]' is added is added.
  2. (opEvents 2.2 and newer only) copy_present is evaluated first. It specifies which properties should be set from their first occurrence.
    This rule must contain explicit property names only, i.e. no regular expressions.
    opEvents checks all trigger events in chronological order, and when it finds an event that has a value for the desired property, it copies that value over and stops looking for that property. Any later events that might have the property as well do  not contribute to the result.
    A rule like copy_present => [ 'alpha', 'beta' ] will pull the alpha and beta properties from wherever they are present for the first time, but independent of each other: a  trigger event can contribute none, either or both properties.
  3. copy_first is evaluated firstnext, and specifies which event properties should be copied over from the earliest trigger event.
    Each listed property is copied over; if the directive contains a regular expression (e.g. qr/cust.*/, then all properties with names matching the regular expression are copied.
  4. copy_last is checked next, and properties listed here are copied over from the most recent trigger event.
    The property copying does overwrite all properties that were set earlier (by copy_first).
  5. copy_highest is checked next, and its properties are sourced from the trigger event with the highest priority.
    Again overwriting of properties may happen.
  6. copy_groupby controls whether any of the grouping property values should be saved in the new event.
    The format is different for this directive: It must be a list of property target names (or the word 'undef'), in the same order as the groupby directive.
    For each element  in the groupby list, the value of the grouping property is saved as the target name in the new event, if a target name is available in the copy_groupby list.
    If no groupby is given for this rule, then a copy_groupby directive has no effect.
  7. Now the enrich clause is checked, and each of  its property name - value pairs indicates which properties should be set to (or overwritten with) a particular static value.
  8. Now  the  nodestateful and element properties are automatically adjusted if required (see below for details).
  9. Finally, the event name is set to the rule name, certain undesirable properties are removed, an audit trail of triggering events is added (by adding the properties nodes and eventids), the event is marked as synthetic and is inserted into the database.

Please note that "earliest event" in step 1 2, 3 and 4 refers to the event with the earliest event timestamp, which does not necessarily reflect its processing order. opEvents processes inputs mostly - but not always - in chronological order. If you have multiple 'earliest' events (all with the same timestamp) then their order is undefined and copy_first will pick a random event. The same caveat applies in step 2 for the "most recent event".

...