Rules reference
Use the following reference information when constructing rules.
Token referencing rules
The rule mechanism supports a number of key use-cases, for example:
- Event correlation
- Merging data from multiple data sources
- Tagging resources
Rules extract data in a common or standardized way to support such use cases. Data structures can be complex, for example they may include nested key-value pairs in maps and lists, and the rule processing mechanism supports the extraction of data from such structures into a variable known as a 'token'. These tokens are used when applying the rules in order to modify the resource records being processed.
For example, you may wish to extract the value of a nested property and combine it with a literal string that you provide and treat that combination as a single resource tag.
Given the following input:
{{{key1=value1, customTags={field1_2=level1, field1_1={field2_2=level2, field2={field3=
{nestedKey=level3}}}}}}}
The following token definitions result in the shown result:
| Token | Result |
|---|---|
key1 |
[value1] |
${key1} |
[value1] |
customTags |
[{field1_2=level1, field1_1={field2_2=level2, field2={field3={nestedKey=level3}}}}] |
${customTags} |
[{field1_2=level1, field1_1={field2_2=level2, field2={field3={nestedKey=level3}}}}] |
${customTags->field1_2} |
[level1] |
${customTags->field1_1} |
[{field2_2=level2, field2={field3={nestedKey=level3}}}] |
${customTags->field1_1->field2_2} |
[level2] |
${customTags->field1_1->field2} |
[{field3={nestedKey=level3}}] |
${customTags->field1_1->field2->field3} |
[{nestedKey=level3}] |
${customTags->field1_1->field2->field3->nestedKey} |
[level3] |
${customTags->field1_1->field2>field3->nestedKey} |
[] |
${customTags->unknown_key} |
[] |
${unknownKey->unknown_key} |
[] |
${customTags->->unknown_key} |
[] |
${customTags->->field1_1} |
[] |
${customTags->} |
[] |
${->customTags} |
[] |
${>customTags>} |
[] |
${key1}and${customTags->field1_2} |
[value1-and-level1] |
| Token | Revious result | New result |
|---|---|---|
{{${whatever}:${name} |
[[foo, boo]:dinoop] |
[foo:dinoop, boo:dinoop]}} |
{{${whatever}:${name}:${place} |
[[foo, boo]:dinoop:india] |
[foo:dinoop:india, boo:dinoop:india]}} |
{{${name}:${whatever} |
[dinoop:[foo, boo]] |
[dinoop:foo, dinoop:boo]}} |
{{${place}:${whatever}:${name} |
[India:[foo, boo]:dinoop] |
india:foo:dinoop, india:bar:dinoop, india:zoo:dinoop}} |
{{${whatever}:newlist |
[[foo, boo]:newlist] |
[foo:newlist, boo:newlist]}} |
| Token | Revious result | New result |
|---|---|---|
{{name |
[dinoop] |
[dinoop]}} |
{{${name} |
[dinoop] |
[dinoop]}} |
{{${place}:${name} }} |
{{[india:dinoop] |
[india:dinoop]}} |
{{${age}:${name} |
[30:dinoop] |
[30:dinoop]}} |
{{${whatever} |
[[foo, boo]] |
[[foo, boo]]}} |
{{whatever |
[boo, foo] |
[boo, foo]}} |
{{mymap |
[{key1=val1}] |
[{key1=val1}]}} |
{{${mymap} |
[{key1=val1}] |
[{key1=val1}]}} |
{{${mymap}:${name} |
[{key1=val1}:dinoop] |
[{key1=val1}:dinoop]}} |
{{${whatever}:${newlist} |
[[foo, boo]:[abc, xyz]] |
[[foo, boo]:[abc, xyz]]}} |
{{${whatever}:${mymap} |
[[foo, boo]:{key1=val1}] |
[[foo, boo]:{key1=val1}]}} |