When Construct

A When construct can be used to test whether a parsed field matches a value or a regular expression pattern.

Case 1: The following checks whether the type field contains 'Success' (case sensitive match) anywhere in the string.

<when test="matches($type,'Success')">

…

</when>

Case 2: The following checks whether the httpsStatusCode field begins with 40, e.g. 400-409

<when test="matches($httpStatusCode,'^40')">

…..

</when>

Case 3: The following checks whether the eventType field does not contain PH_SYSTEM (case sensitive match) anywhere in the string

<when test="not_matches($eventType, 'PH_SYSTEM_')">

</when>

Case 4: The following checks whether the severity field is 6 or 7.

<when test="$severity IN '6,7'">

…

</when>

Case 5: The following checks whether the direction field is ‘inbound’ (exact case-sensitive match)

<when test="$direction = 'inbound'">

….

</when>

Case 6: The following checks whether the direction field is not ‘inbound’ (exact case-sensitive match)

<when test="$direction != 'inbound'">

….

</when>

Case 7: The following checks whether the srcIpAddr field is set to some value.

<when test="exist srcIpAddr">

</when>

Case 8: The following checks whether the srcIpAddr field is not set to some value.

<when test="not_exist srcIpAddr">

</when>

Case 9: The following checks whether the destIpAddr field is not in the RFC 1918 private IP range.

<when test="not_private_ip destIpAddr">

</when>