Rules reference
Use the following reference information when constructing rules.
Token referencing rules
The rule mechanism supports a number of key use-cases, for example:
- Event correlation
- Merging data from multiple data sources
- Tagging resources
Rules extract data in a common or standardized way to support such use cases. Data structures can be complex, for example they may include nested key-value pairs in maps and lists, and the rule processing mechanism supports the extraction of data from such structures into a variable known as a 'token'. These tokens are used when applying the rules in order to modify the resource records being processed.
For example, you may wish to extract the value of a nested property and combine it with a literal string that you provide and treat that combination as a single resource tag.
Given the following input:
{{{key1=value1, customTags={field1_2=level1, field1_1={field2_2=level2, field2={field3=
{nestedKey=level3}}}}}}}
The following token definitions result in the shown result:
| Token | Result |
|---|---|
key1
|
[value1]
|
${key1}
|
[value1]
|
customTags
|
[{field1_2=level1, field1_1={field2_2=level2,
field2={field3={nestedKey=level3}}}}]
|
${customTags}
|
[{field1_2=level1, field1_1={field2_2=level2,
field2={field3={nestedKey=level3}}}}]
|
${customTags->field1_2}
|
[level1]
|
${customTags->field1_1}
|
[{field2_2=level2,
field2={field3={nestedKey=level3}}}]
|
${customTags->field1_1->field2_2}
|
[level2]
|
${customTags->field1_1->field2}
|
[{field3={nestedKey=level3}}]
|
${customTags->field1_1->field2->field3}
|
[{nestedKey=level3}]
|
${customTags->field1_1->field2->field3->nestedKey}
|
[level3]
|
${customTags->field1_1->field2>field3->nestedKey}
|
[]
|
${customTags->unknown_key}
|
[]
|
${unknownKey->unknown_key}
|
[]
|
${customTags->->unknown_key}
|
[]
|
${customTags->->field1_1}
|
[]
|
${customTags->}
|
[]
|
${->customTags}
|
[]
|
${>customTags>}
|
[]
|
${key1}and${customTags->field1_2}
|
[value1-and-level1]
|
| Token | Revious result | New result |
|---|---|---|
{{${whatever}:${name}
|
[[foo, boo]:dinoop]
|
[foo:dinoop, boo:dinoop]}}
|
{{${whatever}:${name}:${place}
|
[[foo, boo]:dinoop:india]
|
[foo:dinoop:india, boo:dinoop:india]}}
|
{{${name}:${whatever}
|
[dinoop:[foo, boo]]
|
[dinoop:foo, dinoop:boo]}}
|
{{${place}:${whatever}:${name}
|
[India:[foo, boo]:dinoop]
|
india:foo:dinoop, india:bar:dinoop,
india:zoo:dinoop}}
|
{{${whatever}:newlist
|
[[foo, boo]:newlist]
|
[foo:newlist, boo:newlist]}}
|
| Token | Revious result | New result |
|---|---|---|
{{name
|
[dinoop]
|
[dinoop]}}
|
{{${name}
|
[dinoop]
|
[dinoop]}}
|
{{${place}:${name} }}
|
{{[india:dinoop]
|
[india:dinoop]}}
|
{{${age}:${name}
|
[30:dinoop]
|
[30:dinoop]}}
|
{{${whatever}
|
[[foo, boo]]
|
[[foo, boo]]}}
|
{{whatever
|
[boo, foo]
|
[boo, foo]}}
|
{{mymap
|
[{key1=val1}]
|
[{key1=val1}]}}
|
{{${mymap}
|
[{key1=val1}]
|
[{key1=val1}]}}
|
{{${mymap}:${name}
|
[{key1=val1}:dinoop]
|
[{key1=val1}:dinoop]}}
|
{{${whatever}:${newlist}
|
[[foo, boo]:[abc, xyz]]
|
[[foo, boo]:[abc, xyz]]}}
|
{{${whatever}:${mymap}
|
[[foo, boo]:{key1=val1}]
|
[[foo, boo]:{key1=val1}]}}
|