How do I enrich events?

To define a rule that adds a location to the Port Speed Change event

In Entuity, events include a standard set of attributes, e.g. source, name, severity. Please see this article for further information on the standard event attributes.

You can add additional attribute information to the event and store it in the database. The below example demonstrates how to add additional information to the event by adding a location to the Port Speed Change event. It involves the following stages:

• creation of a Pre Storage Generic processing stage and rule.
• Event Type Test matching on the Port Speed Change event type.
• a new database attribute to hold the location of a port.
• Groovy script that navigates the Entuity type hierarchy to identify a port's location, through attributes held against its device:
  

  source.device.sysLocation

To define a rule that adds a location to the Port Speed Change event:

1. Click Main Menu and then Administration. This will open the Administration page.
2. Click Event Administration. On the Event Administration page, click the Rules tab.
3. On the left, click Pre Storage and then click Add Processing Stage.
4. In the Add Processing Stage window, define the stage with the Name of 'Enrichment' and a Description of 'Add new attributes to events.' Click OK to save.
   
   
   
   
5. Select the Enrichment processing stage from the list of processing stages, and then click Add Rule.
   
   
   
   
   1. Set the Type to 'Generic', and enter a meaningful Name and Description to the rule.
   2. Set Condition to 'All tests must succeed'.
   3. Add an Event Type Test that matches on Port Speed Change.
   4. Add an Action Step:
      • Type set to 'Set Attribute'
      • Attribute set to 'New Attribute'. For the New Custom Event Attribute, enter a Name, set Storage to 'Database', and enter a Description. Click OK.
      • Value, enter:
        

        source.device.sysLocation

      • Click OK to save the action step.
   5. Click OK to save the rule.
6. Save and deploy the new event project.