TIBCO LogLogic LMI: How to Ignore Case in Correlation Bloks
Article ID: KB0077882
Updated On:
| Products | Versions |
|---|---|
| TIBCO LogLogic Enterprise Virtual Appliance | 6.2.0 and higher |
Description
By default correlation bloks are case-sensitive.
For example, consider a data model, myTestModel, that obtains logs from various sources. The data model contains a property called payload. The payload property captures a string in which the capitalization varies. It may be test in some logs and TEST in others, or a mixture of uppercase and lowercase letters. A correlation blok can be defined that uses the payload parameter:
USE myTestModel WITHIN 5m EVENT GROUP [EG1] AT LEAST 1 EVENTS WHERE payload = 'test'
A correlation blok may also be used in defining a Trigger ((Management > Advanced Features > Rule Management). If the above correlation blok was used, only logs containing a payload of test would trigger an alert. Any logs with a payload of TEST or mixed case such as TesT would be ignored by the correlation blok.
This may be desired. However, if all forms of test should trigger an alert then the payload parameter should be made case-insensitive.
For example, consider a data model, myTestModel, that obtains logs from various sources. The data model contains a property called payload. The payload property captures a string in which the capitalization varies. It may be test in some logs and TEST in others, or a mixture of uppercase and lowercase letters. A correlation blok can be defined that uses the payload parameter:
USE myTestModel WITHIN 5m EVENT GROUP [EG1] AT LEAST 1 EVENTS WHERE payload = 'test'
A correlation blok may also be used in defining a Trigger ((Management > Advanced Features > Rule Management). If the above correlation blok was used, only logs containing a payload of test would trigger an alert. Any logs with a payload of TEST or mixed case such as TesT would be ignored by the correlation blok.
This may be desired. However, if all forms of test should trigger an alert then the payload parameter should be made case-insensitive.
Issue/Introduction
This article explains how to make correlation bloks case-insensitive.
Environment
Correlation was introduced in LMI 6.2.0 and requires advanced features to be enabled.
Resolution
To ensure that all variations of test can be captured, use the lower function.
USE myTestModel WITHIN 5m EVENT GROUP [EG1] AT LEAST 1 EVENTS WHERE lower(payload) = 'test'
There is also an upper function, which converts the payload to uppercase.
USE myTestModel WITHIN 5m EVENT GROUP [EG1] AT LEAST 1 EVENTS WHERE upper(payload) = 'TEST'
There may be a use for checking only those logs that contain a payload of test or TEST. This can be achieved by specifying each of the two case-sensitive options:
USE myTestModel WITHIN 5m EVENT GROUP [EG1] AT LEAST 1 EVENTS WHERE payload = 'test' OR payload = 'TEST'
USE myTestModel WITHIN 5m EVENT GROUP [EG1] AT LEAST 1 EVENTS WHERE lower(payload) = 'test'
There is also an upper function, which converts the payload to uppercase.
USE myTestModel WITHIN 5m EVENT GROUP [EG1] AT LEAST 1 EVENTS WHERE upper(payload) = 'TEST'
There may be a use for checking only those logs that contain a payload of test or TEST. This can be achieved by specifying each of the two case-sensitive options:
USE myTestModel WITHIN 5m EVENT GROUP [EG1] AT LEAST 1 EVENTS WHERE payload = 'test' OR payload = 'TEST'
Feedback
Yes
No
Powered by
