It is suggested to use SQL patterns instead of regular expressions if possible because regular expressions are slower than SQL patterns.

In this example events are to be grouped using their device and devtype property. The value 7thFloor-Hosts is needed for all events whose device property begins with fl7- and whose devtype is host.

The value 8thFloor-All is needed for all events whose device property begins with fl8- and has anything for a devtype.

The value Routers-R is needed for all events whose device property contains within an r followed by three digits and router for devtype.

The value Others is needed for all events that have not matched for device and devtype.

Example configuration file: 

<?xml version="1.0" encoding="UTF-8"?>
<property-tagging-filter-config
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.watch4net.com/APG/Filter/PropertyTaggingFilter
property-tagging-filter-config.xsd"
xmlns="http://www.watch4net.com/APG/Filter/PropertyTaggingFilter">
<refresh unit="minutes">20</refresh>
<files>
<text-file path="conf/input.data">
<field-separator>, </field-separator>
<default-symbol>***</default-symbol>
<key-properties>
<key-property delete-after-use="false" string-type="regex">device</key-property>
<key-property delete-after-use="false" string-type="regex">devtype</key-property>
</key-properties>
<new-properties>
<new-property>group</new-property>
</new-properties>
</text-file>
</files>
</property-tagging-filter-config>

Be careful with regular expressions added to the input file since there are many ways to use them, and it is easy to create one that will overwrite another. For example, if you create a line with abc.* and another with .*def and the value abcdef passes the filter, it will match both lines. The last match will overwrite the preceding match.

Example input file:

Using the example above and processing the following events:

device

devtype

Event 1

fl7-asd-56

host

Event 2

fl7-fas-42

router

Event 3

fl8-rew-rwe

host

Event 4

fl123-qwe-r342-wq

router

Returns these results:

device

devtype

group

Event 1

fl7-asd-56

host

7thFlppr-Hosts

Event 2

fl7-fas-42

router

Others

Event 3

fl8-rew-rwe

host

8thFloor-All

Event 4

fl123-qwe-r342-wq

router

Router-R