Gergely Nagy <algernon@balabit.hu> writes:
Balazs Scheidler <bazsi77@gmail.com> writes:
what about introducing a template function that expands to the number of elements in the context?
Mmm... that would require extending LogTemplate, and would also mean we have to expand templates in dbparser at action calling time, which sounds inefficient to me.
...and I was so very wrong! While not a template function, but something equally simple was very easy: exporting the context length as the $CONTEXT_LENGTH variable gets pretty much the same thing done. While this solution has the side-effect of always adding CONTEXT_LENGTH to a message when there is a context, it's also a lot lighter than a template function, in my opinion. (The template function would have to go through some hoops while getting called, and would need to look up the context via context_id... a rather long dance) This means that <action condition='"${CONTEXT_LENGTH}" <= "2"'> works, and one can use any kind of template function too, so this would work too: <action condition='"$(% ${CONTENT_LENGTH} 10)" == "0"'> I pushed this - and a slightly reworked <message inherit-properties='TRUE'> patch - to the feature/3.4/dbparser/corellation-improvements branch, and will merge them to merge-queue/3.4 shortly. -- |8]