...
| Code Block |
|---|
'policy' => {
'1' => {
IF => 'node.customer eq "important"',
THEN => {
'10' => {
IF => 'node.roleType eq "core" and event.event =~ "qr{Down"}',
THEN => 'log.disaster() AND escalate.twentyfourseven()',
BREAK => 'true'
},
'20' => {
IF => 'node.roleType eq "distribution" and event.event =~ "qr{Down"}',
THEN => 'priority(+2) AND email(admin)',
BREAK => 'false'
},
BREAK => 'false'
},
'2' => ...
}, |
...
The IF expression is basically any arbitrary Perl expression, but tokens of the form event.name or node.name are substituted with the respective event or node property value. The special wildcards event.any and node.any are replaced by a logical true value. Furthermore, tokens that match extdb.queryname.column will be substituted with the result of an external enrichment query.
Please note that for maximum robustness you should express any regular expression in IFs as /regexp contents/ or qr{regexp contents}, NOT as "regexp contents": the doublequoted variant only works for very simple patterns.
The substituted values are inserted into the expression in double quotes. In versions 2.0.4 and above, the special characters @%$"` are backslash-escaped to ensure that Perl does not interpret them when the expression is evaluated. In version 2.0.4 and above, purely numeric values are inserted unquoted as they are; before they were inserted double-quoted like strings.
...