Correlator triggers

Triggers define output of correlators. They live in the trigger section of the correlator. Each correlator can define many triggers (it is a list).

The trigger can access the original event by !EVENT statement, it is the last event that passed evaluation test.

The value from the aggregator function is availabe at !ARG.

event trigger

This trigger inserts a new event into the primary data path.

Example of the event trigger:

  - event:
        AnalyzeValue: !ARG
        LastEvent: !EVENT
        AnotherAttribute: Foo

lookup trigger

Lookup trigger manipulates with the content of the lookup. It means that it can add (set) and remove (unset) an entry in the lookup.

The entry is identified by a key, which is a unique primary key.

Example of the trigger that adds an entry to the lookup UserList:

  - lookup: UserList
    key: !ITEM EVENT UserName
      Timestamp: !NOW
      Foo: Bar

Example of the trigger that removes an entry from the lookup UserList:

  - lookup: UserList
    delete: !ITEM EVENT UserName

Remark: Lookup entries can be accessed from the declarative expressions by !LOOKUP.GET and !LOOKUP.CONTAINS entries.