event process filtering script - catch and break event parameter

[amitayb]

Hi,
I catch an event using EPP.
I need to catch the event first parameter and regex it to catch relevant data from it.
that create new event where my catched data should be a parameter - will use as event key.

any idea how shold I implement it?
I saw this example:
$event->parameters[1] == %1

in my case: the param is: bigipNotifyObjMsg = SNMP_TRAP: Virtual /Common/WEBCMSTEST_VIP-HTTPS has become unavailable
I need to catch "/Common/WEBCMSTEST_VIP-HTTPS" and create new event from it.

I assume event filter is the way.
how can I test the results?
whats the best way to do it?
any examples?

[victor]

Hi,

for event generation you can use PostEvent function. You can put everything into your filter script, but this seems a bit illogical, or create a script action. I would create a rule that matches event and executes script action. Inside that script (either filter script or action script) you can use something like this:

if ($event->parameters[1] ~= "^SNMP_TRAP: Virtual (.*) has become unavailable")
{
   PostEvent($node, "CUSTOM_EVENT", null, $1);
}

This will generate new event named CUSTOM_EVENT with path extracted from original event passed as first parameter.

Best regards,
Victor