SIM:ViewDef

From RuleCore Support

Overview

Views are defined using the AddViewDef system event and are found in the SIM as ViewDef items in the container located at /SysInfo/Items/Type[@name="ViewDef"]

Contents

The view defines a view into the inbound stream of events. The view is a private and continuously updated window into the inbound event stream automatically maintained for each rule instance.

The view is defined using a number of view properties which much hold and be true for each and every event in the view.

The type view property is the only required property. The others can be combined as needed.

Properties

Below is listed all the properties available for constraining what events should be present in the view.

Type

The event type property constraints the events in the view to a number of specified types.

The event type property is defined using the <Type> element in the <View> element. The <Type> element contains a number of Event elements, each specifying an user event that should be considered for inclusion in the view.

The <Event> element contains a ruleCore XPath expression which must resolve to an user event definition in the SIM. The expression is evaluated in the default context /SysInfo/Items/Type[@name="UserEventDef"]

Example: Create a view with events of types A,B and C.

<Type>
 <Event><base:XPath>sim:EventDef[@eventType="A"]</base:XPath></Event>
 <Event><base:XPath>sim:EventDef[@eventType="B"]</base:XPath></Event>
 <Event><base:XPath>sim:EventDef[@eventType="C"]</base:XPath></Event>
</Type>

Match

The match property is used to include events in the view only if a certain parts of the event contents match, e.g. if the value of an event property match or the value of an XPath expression match. It is commonly of interest to include events which are somehow semantically related my means of matching parts of the event content.

Value

Events are considered to match if the given properties evaluate to the same value for two or more events.

Example:

Include only events of type StartTransaction and EndTransaction if they both relate to the same transaction as specified by the TransactionID event property.

The match is strict, so all other events than those being of type StartTransaction or EndTransaction are not considered for inclusion in the view. Thus we only expect to see these two types of events in the view with matching transaction ids and nothing else.

<!--
  -- Excerpt from the event type definitions
  -->
<EventDef eventType="StartTransaction">
  <Properties>
    <Property name="TransactionId">
      <Expression><base:XPath>string(base:EventBody/TransactionID)</base:XPath></Expression>
    </Property>
  </Property>
</EventDef>
 
<EventDef eventType="EndTransaction">
  <Properties>
    <Property name="TransactionId">
      <Expression><base:XPath>string(base:EventBody/TransactionID)</base:XPath></Expression>
    </Property>
  </Property>
</EventDef>
 
<!--
  -- View definition, events StartTransaction/EndTransaction w/ matching TransactionId
  -->
<View>
 
  <Type>
    <Event><base:XPath>sim:EventDef[@eventType="StartTransaction"]</base:XPath></Event>
    <Event><base:XPath>sim:EventDef[@eventType="EndTransaction"]</base:XPath></Event>
  </Type>
 
  <Match>
    <Value>
      <Event><base:XPath>sim:EventDef[@eventType="StartTransaction"]</base:XPath></Event>
      <Property name="TransactionId">
    </Value>
    <Value>
      <Event><base:XPath>sim:EventDef[@eventType="EndTransaction"]</base:XPath></Event>
      <Property name="TransactionId">
    </Value>
  </Match>
 
</View>

Assert

The assert property is used to assert that an XPath expression is true when evaluated on each inbound event as the event is considered for inclusion in the view. All events for which the expression evaluates to true, are considered for inclusion in the view.

<Assert>
  <Event><base:XPath>sim:EventDef[@eventType="ERROR"]</base:XPath></Event>
  <Expression><base:XPath>base:EventBody/IPAdress/child::text() = '122.234.0.102'</base:XPath></Expression>
</Assert>

MaxCount

The maximum count of events in the view can be restricted with the MaxCount. The view will never contain more events than specified using the max count property.

The oldest events are removed from the view if needed to satisfy the max count property.

Example:

<MaxCount>100</MaxCount>

MaxAge

The max age property specifies the maximum age of the events in the view. It's used to create a window into the inbound event stream which contains events from the last X minutes.

The maximum age of the events is defined using the MaxAge element. It contains a time specification in the form HH:MM:SS.

Example: Create a view which contains a window into the last minute of events. Only events from the last minute are present in the view.

<MaxAge>00:01:00</MaxAge>

Unique

The unique property specifies that the view should not at any time contain any two events having the same value for the given event property. The view will contain only the first event having a specific property value.

Example:

<Unique>
  <Property name="Color"/>
</Unique>