By-position qualifiers

The correlator evaluates a positional event template against the event field that is at the same position in the event definition as the qualifier's position in the qualifier list.

For example, suppose an event has the fields shown below:

event sample1

{

string itemName;

float price;

integer quantity;

}

{

string itemName;

float price;

integer quantity;

}

An example of a by-position qualifier list for this event is as follows:

sample1 ("eggs", 0.50, 3)

This template matches sample1 events that have an itemName value of "eggs", a price value of 0.50, and a quantity value of 3.

In a by-position qualifier, an asterisk (*) matches any value of an event field in the corresponding position.

A range expression matches the event field values in the corresponding position to a low and high boundary value of the range. A match occurs when the field value is within the range. See Range expressions.

The comparison operators < (less than), <= (less than or equal to), > (greater than), >= (greater than or equal to), and = (equal to) specify a comparison of the event field value with the expression value that follows. A match occurs when the relation result is true. The expression to the right of the comparison operator cannot contain any references to the event's fields and must have a result type that is the same as the event field's type and must be one of decimal, float, integer or string.