![]() |
![]() |
Subject: | [solved] replacing old event by new event in console |
Author: | [Not Specified] |
Posted: | 2016-06-06 10:04 |
Hello we have many events on console which differ only by one variable (time). Is there any way to delete previous event from console and replace it by new one The goal is to have just last event with last variable value (having this last variable value is important). Current situation is that when we already have event:
some fancy event 35
and new event:
some fancy event 22
will come, we have in console:
some fancy event 35
some fancy event 22
and the goal is to have in console only:
some fancy event 22
Should I use Transform for that Could anybody can share some Transform which do similar thing Unfortunately I was able to find only transforms which drops new event, and I want to drop (remove from console) the old one.
Subject: | You can do this with a |
Author: | Jane Curry |
Posted: | 2016-06-08 09:22 |
You can do this with a transform on the Event Class. Depends a bit on whether the event class is used for events other than the pattern you have described Set the event class transform by navigating to EVENTS -> Event Classes and navigate down to the correct class. You get at the transform from the Action (gear) icon at the bottom of the left-hand menu. Try this:
import re
fk=re.match(r'^some fancy event\s*\d+$', evt.summary)
if fk:
evt.eventKey = 'fancy event'
Make sure you get the white space correct.
Basically the regular expression (re) utility looks for some fancy event followed by zero-or-more whitespace (\s*), followed by one-or-more numbers (\d+). ^ is start-of-string. $ is end-of-string.
If a match is found in the evt.summaryt field then set the eventKey field simply to 'fancy event'.
The trick here is to turn "matching" events into duplicate events. A duplicate is defined as having the device, component, event class, severity and eventKey fields the same. If eventKey is null (and this solution depends on your eventKey field being null at the outset), then the event summary field is also used to detect duplicates. The transform changes the dedupid field from using the summary to using a non-null, identical eventKey.
When a duplicate is detected, the event count increases and the event summary field shows that from the most recent event.
Cheers,
Jane
Email: jane.curry@skills-1st.co.uk Web: https://www.skills-1st.co.uk
Subject: | thx :) |
Author: | [Not Specified] |
Posted: | 2016-06-09 06:27 |
thx :)
< |
Previous ubuntu14.04 monitoring with zenoss 4.2.3 |
Next Process monitoring memory use |
> |