How to derive by generating conditions with routeoncontent processor?

[#1]

Hello,

I have a set of syslog lines coming in one by one. Since I want to send them to different processors for storage, I want to derive them according to a series of conditions.

A fellow member of the community indicated to me that he could use the RouteOnContent processor. In fact I have derived the logs according to a contained word towards one site or another.

Property Country = (. *USA. *)

But the problem I have now is that I find it necessary that the condition to derive is more than one word and I am not sure how to do it.

e. g. my log line is as follows:

2017, michigan, january, rainy, 20, eeuu, cloudy

I want to send to the site' A' if it contains the word January and USA.

I want to send to site' B' if it contains January and cloudy

I want to send to site' C' if it contains January or February and the USA.

Thank you so much for the help.

[#2 · Accepted solution]

Hi @xav webmaster, we can do this by using routeoncontent processors, But in your case the problem is your siteA and siteC having jan and usa as common check on content, you need to come up with unique way how to route content to siteA or siteC.

by using RouteOnContent Processor:-

This processor also results same output as routetext but in this processor we won't have ignore case property, so we need to prepare regex which matches january or January or jaNuary.

The below regex ignores all the case mentioned above

.*[Jj][Aa][Nn][Uu][Aa][Rr][Yy].*

Configs:-

1.change the properties

Match Requirement to content must contain match

2.add the below properties

jan and cloudy

(.*January.*Cloudy) // checks if the content haiving january and cloudy in it
Example:- 2017, michigan, January, rainy, 20, eeuu, Cloudy

jan and usa

(.*January.*USA) //checks if the content having january and usa in it
Example:- 2017, michigan, January, rainy, 20, eeuu, USA

jan or feb and usa

(January|February).*(USA) //checks if the content having jan or feb and usa
Example:- 
2017, michigan, February, rainy, 20, eeuu, USA
2017, michigan, January, rainy, 20, eeuu, USA

in this case both content satisfies regex

Processor Configs:-

in addition:-

How RouteText processor works?

if you are having content with 50 lines in it and we wants to route the content, this processor compares each line with our properties and routes the matching lines to those relationships.

i.e 1 input file(multiple lines of content) and multiple outputs based on relations that we specified in processor configurations

Example input:-

2017, michigan, January, rainy, 20, eeuu, Cloudy
2017, michigan, January, rainy, 20, eeuu, USA
2017, michigan, February, rainy, 20, eeuu, USA

output:-

jan and usa relation gets

2017, michigan, January, rainy, 20, eeuu, USA

jan and cloudy

 2017, michigan, January, rainy, 20, eeuu, Cloudy

jan or feb and usa

2017, michigan, January, rainy, 20, eeuu, USA
2017, michigan, February, rainy, 20, eeuu, USA

(or)

if the content of flowfile will have only 1 line in it, in that case we can use routetext processor and it works same as routeoncontent as mentioned above.

Processor Configurations:-

1.change the properties

Matching Strategy to Contains Regular Expression

Ignore case to true //it ignores UPPER or lower case

2.add properties as follows

jan and cloudy

(.*January.*Cloudy) // checks if the content haiving january and cloudy in it
Example:- 2017, michigan, January, rainy, 20, eeuu, Cloudy

jan and usa

(.*January.*USA) //checks if the content having january and usa in it
Example:- 2017, michigan, January, rainy, 20, eeuu, USA

jan or feb and usa

(January|February).*(USA) //checks if the content having jan or feb and usa
Example:- 
2017, michigan, February, rainy, 20, eeuu, USA
2017, michigan, January, rainy, 20, eeuu, USA

in this case both content satisfies regex

Processor configs:-

• If your content of flowfile is one line at a time you can use either routetext (or) routeoncontent processors, the results from both of them are same. As you can choose which best fit for your case.
• if your contents are more than one line at a time then by using routetext we can routes the matching lines to different relations (or) use splittext processor to split each line as a flowfile then use either routetext (or) routeoncontent processors.
• if your contents are more than one line at a time and you want to route the whole content based on some property then use routeoncontent processor it will compares whole contents(not line by line as routetext) and redirects the whole contents to matching relationships.

[#3]

That's a great answer. Thank you so much for the help. It'll really come in handy. I can see that he has taken time to respond, and I thank him for that.