Hi,
I have basically the same problem, or I just imagine so
My event configuration in /opt/ca/Spectrum/custom/Events/EventDisp:
0x67700338 E 0
P " \
SetVariable({V pattern},{S \"(?<=reason: )(.*)(?=] At)|(?<=event )(.*)(?= occurred)|(?<=tenant )(.*)(?= as)|(?<= as )(.*)\"}, \ SetVariable({V counter},{U 500}, \
If(Regexp(GetEventVariable({U 1}),{V pattern}), \
CreateEventWithVariables({C CURRENT_MODEL},{H 0x67700383}, \ ForEach(GetRegexpList(\
GetEventVariable({U 1}),{V pattern}),{Variable X}, \
{Variable retVal},GetEventVariableList(), \
Prog2(Assign({V retVal},SetEventVariable({V retVal},{V counter},{Variable X})), \ Assign({V counter},Add({V counter},{U 1}))))), \
CreateEventWithVariables({C CURRENT_MODEL},{H 0x67700383}, GetEventVariableList()))))"
Event 0x67700338 looks like this:
A "loadbalancerSystemAlert" event has occurred, from Host_Device device, named loadbalancer1.testdomain.net.
This is a generic system alert
loadbalancerSystemAlertInfoDesc = [accounts-api-server-pool-8080-tcp: reason: VIP-EVENTS-MEDIUM] At 2018-10-10 13:24:20+00:00 event POOL_DOWN occurred on object accounts-api-server-pool-8080-tcp in tenant API-TN as Pool is DOWN.
I have followed documentation and this discussion, but no luck. Event 0x67700338 keeps coming but parsed event do not appear.
I have suspected that my regexp not working, but it seems to be OK, I have checked it like this:
[spectrum@spectrum-server ~]$ cat test_test.txt
loadbalancerSystemAlertInfoDesc = [accounts-api-server-pool-8080-tcp: reason: VIP-EVENTS-MEDIUM] At 2018-10-10 13:24:20+00:00 event POOL_DOWN occurred on object accounts-api-server-pool-8080-tcp in tenant API-TN as Pool is DOWN.
[spectrum@spectrum-server ~]$
[spectrum@spectrum-server ~]$ cat test_test.txt | grep -oP "(?<=reason: )(.*)(?=] At)|(?<=event )(.*)(?= occurred)|(?<=object )(.*)(?= in)|(?<=tenant )(.*)(?= as)|(?<= as )(.*)"
VIP-EVENTS-MEDIUM
POOL_DOWN
accounts-api-server-pool-8080-tcp
API-TN
Pool is DOWN.
Another question, do I have to configure varbinds on new event 0x67700383 in advance?