Parameterized Filters

Filter parameterization is useful when you want to let an operator configure a filter at runtime. If the record in Filter Rules is marked as Parameterized, filter may require user to input one or more parameters during its activation (i.e. selection from a drop-down list in Event Log).

Parameterization is a complex subject, which is beyond the extent of this topic. However, to understand this section, you must have a complete understanding of the Parameterization process and engine. So, if you'd like to use Parameterized Filters and you're unfamiliar with the subject, you should now skip to Parameterization Engine, read the whole topic until you're fully familiar with parameterization, and then come back here.

As covered above, the Filter Rules property contains many lines (records), each describing an event type which the filter passes. Each record may contain a filter expression (which may be parameterized). Even if the Filter Rules property contains more than one such parameterized Filter Expression, all filter parameters are entered in one single dialog. The Event Filter uses an Edit Data UI Procedure to prompt for filtering parameters.

When the Parameterized option is enabled in the Filter Rules record, the filter processing engine uses Parameterizer Source Data to build Filter Expression in real-time based on a number of operator-specified parameters. For more information, see Parameterization Engine.

Here is an example of Parameterizer Source Data with one string field in Format (username) and Parameterized Expression:

{username} ~= '.*<e>{username}</e>.*'

A filter containing this Parameterized Expression will generate a dialogue asking for a Username parameter, upon activation.

This filter will pass only events whose username field contains the value entered by an operator as the Username parameter, because the resulting Filter Expression will be:

{username} ~= '.*<e>VALUE_OF_USERNAME_PARAMETER_ENTERED_BY_USER</e>.*'

Again, this isn't really supposed to make much sense at this point of the manual -- it's just a glimpse at the power of parameterized filters. To really understand how this works, you have to read about the Parameterization Engine.

This function automatically generates parameterization data for event categories selected from within Filter Rules. You can auto-parameterize a Filter Rules record only if it doesn't already contain a Filter Expression. The auto-parameterization action flow is described in the Event Filter context reference under the unique action Parameterize.
Parameterization data generated by this function defines two parameters per every field in the event's Data Table. I.e, when applying auto-parameterization to an event which has only one field defined in its Event Format property, the user will be prompted to enter two values upon filter execution.

• "Filter by 'description_of_field (name_of_context_where_event_is_defined)'": This would be something like Filter by 'Username (users)'. It's a Boolean value (in other words, a checkbox) which enables or disables filtering by the value of this field.

• "description_of_field (name_of_context_where_event_is_defined)": This would be something like Filter by 'Username (users)'. It's a textbox (or another editing control, depending on the field type) in which you can enter the value you want to filter by.

For example, if we apply auto-parameterization to the Administration Events category, parameterization data will define two parameters: Filter by 'Info (administration)' and Info (administration).

The first parameter enables filtering by the Info field of the Info event (in the administration context). The second parameter contains the expected value for the field. Only events with an Info field equal to this value will pass the filter.

Was this page helpful?

Tell us more

Send

Thank you!