The admin property is to be added to events. The value alice is needed for all events that have host for devtype and interface for parttype. The value bob is needed for all events that have router for devtype and interface for parttype . The value carl is needed for all events that have router for devtype and anything else for parttype. The value ernest is needed for all events that have anything else for devtype and disk for parttype . The value david is needed for all events that did not match for devtype and parttype.

Example configuration file:

<?xml version="1.0" encoding="UTF-8"?>
<property-tagging-filter-config
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.watch4net.com/APG/Filter/PropertyTaggingFilter
property-tagging-filter-config.xsd"
xmlns="http://www.watch4net.com/APG/Filter/PropertyTaggingFilter">
<refresh unit="minutes">20</refresh>
<files>
<text-file path="conf/input.data">
<field-separator>;</field-separator>
<default-symbol>**</default-symbol>
<key-properties>
<key-property delete-after-use="false" string-type="string">devtype</key-
property>
<key-property delete-after-use="false" string-type="string">parttype</key-
property>
</key-properties>
<new-properties>
<new-property>admin</new-property>
</new-properties>
</text-file>
</files>
</property-tagging-filter-config>

Wrong example of an input file:

host; interface ; alice
router ; interface ;bob
router ;**; carl
**; disk;ernest
**;**; david
This wrong example illustrates a limitation of the module. Because an event matching the line with ernest also matches the line with david , the line with david will always overwrite the one with ernest. The way to solve this problem is simply to move the line with david anywhere before the line with ernest.
Note: Lines are matched on subsequent lines only when there are multiple default-symbols used. See General Concepts on Matching Order.

Correct example of an input file:

host; interface ; alice
router ; interface ;bob
router ;**; carl
**;**; david
**; disk;ernest

Using the correct example above and processing the following events:

devtype

partype

Event 1

host

interface

Event 2

router

interface

Event 3

router

disk

Event 4

host

disk

Event 5

switch

processor

Return these results:

devtype

partype

admin

Event 1

host

interface

alice

Event 2

router

interface

bob

Event 3

router

disk

carl

Event 4

host

disk

ernest

Event 5

switch

processor

david

According to above example, it is possible to add ernest for the admin property because it overwrites the david entry.