Writing Connector Policy › Policy Operations › Parse Operation › Parse Property—Splits Event Properties

Parse Property—Splits Event Properties

Parse operations begin with a <Parse> property. The <Parse> property splits event properties into additional properties using regular expression subgroups.

This property has the following format:

<EventClass name=>
   <Parse>
       <Field input= pattern= output= />
   </Parse>
</EventClass>

name

Defines the name of the event class that you are using to create the connector policy.

input

Defines the event property to parse into subgroups.

pattern

Defines the regular expression pattern that the input event property must match for the event to be parsed. The pattern is divided into subgroups designated by parentheses. If the input event property matches the pattern, it is separated into one property for each subgroup.

output

Defines the output properties to assign to the parsed input event property subgroups. The output properties correspond to the regular expression subgroups in the pattern. The first output property is assigned to the first subgroup, the second output is assigned to the second subgroup, and so on. Output property values may be new properties or existing properties.

Example: Parse CA NSM DSM events into additional properties

The following example creates three new properties from one specific event property of events received from CA NSM (through the DSM component) and moves the trap description in the event to the trapdef output property:

<EventClass name="OPR-DSMEVENT">
   <Parse>
       <Field input="tagA" pattern="^(.*)-(.*)$" output="tagA1,tagA2" />
       <Field input="tagA1" pattern="^(\d\d)(\w+)$" output="tagA1a,tagA1b" />
       <Field input="tagQ" pattern="^TRAP:(.*)$" output="trapdef" />
   </Parse>
</EventClass>

This Parse operation searches the event class OPR-DSMEVENT for events containing the input property "tagA" and parses this property into two separate properties (tagA1, tagA2) by separating the values on either side of a dash. The value parsed into tagA1 is then further parsed into two more separate properties (tagA1a, tagA1b). This operation also takes the TRAP description from events with the "tagQ" property and puts it into the trapdef output property.