SAFL (RTC)

Streaming Correlator uses its own SAFL dialect, SAFL (RTC), for rule conditions. An expression in this dialect is evaluated for every incoming event and returns a Boolean value: true or false. SAFL (RTC) includes most standard SAFL functions and extends them with functions designed for streaming event processing.

Where It Is Used

SAFL (RTC) expressions are configured in the following fields of the rule and active list editors:

• Firing Condition of a declarative rule, evaluated for every event. See Declarative Rules
• Pre-filter of an aggregation rule and Filter of an individual metric. See Aggregation Rules
• Firing Condition of an aggregation rule, which operates on metric names rather than event fields
• Pre-filter of an imperative rule, Condition of an Event stage, and Event That Cancels the Incident of an Absence stage. See Imperative Rules
• Stream Filter of an active list, which selects events for automatic population. See Active Lists

All these fields except the Firing Condition of an aggregation rule are evaluated against incoming event fields. Otherwise, the dialect behaves consistently regardless of which field contains the expression.

Referencing Event Fields

An event field is written as a dot-separated path. A path that begins with @ is written without quotes. If a field name contains a space or other characters outside the usual set, enclose it in single quotes:

event.code == "4625"
@timestamp != nil
'user name' == "admin"
'x-forwarded-for' != nil

Important

Single quotes denote a field and double quotes denote a string. A name in single quotes is one whole path: dots inside it are not split into segments.

A field name that collides with a function name must also be enclosed in single quotes, otherwise the expression is rejected when the rule is saved. This applies only to the first path segment: match.name is valid, while a bare now is not and must be written as 'now'.

Logical field names defined by the rule's Field Mapping are used in an expression alongside physical ones. See Streaming Jobs.

Operators

Category	Operators
Logical	and, or, not and their equivalents &&, ||, !
Comparison	==, !=, <, <=, >, >=
Arithmetic	+, -, *, /, %
Grouping	Parentheses

Literals

Literal	Notation
String	Double quotes: "4625"
Number	4625, 3.5, -1
Boolean	true, false
Absent value	null

Installation

2 items

Settings and Management

5 items

Streaming Jobst

3 items

Active Lists

Streaming Correlator active lists: list management, record parameters, replication and node placement, automatic population from the event stream, and use in rules.

SAFL (RTC)

Syntax of the SAFL (RTC) dialect: referencing event fields, operators, literals, and differences from standard SAFL.