search

Event Classes

Event Classes are used to group together specific types of events. This can be useful for situations where an event should be dropped or text should be altered to be more human readable. This is typically done through a python transform.

To define a class, supply the path to the class or classes. Then, for each event class, supply the appropriate properties for the class. These include the option to remove the event class during ZenPack installation/uninstallation, description, and a transform. You can also define mappings to apply to events based on a key and supply an explanation and/or resolution to an issue.

When you define an event class and/or mapping which already exists, any settings defined in your ZenPack will overwrite existing settings.

The following example shows an example of a zenpack.yaml file with an example of a definition of an event class.

zenpack.yaml
name: ZenPacks.acme.Events

event_classes:
  /Status/Acme:
    remove: false
    description: Acme event class
    mappings:
      Widget:
        eventClassKey: WidgetEvent
        sequence:  10
        remove: true
        transform: |-
          if evt.message.find('Error reading value for') >= 0:
              evt._action = 'drop'


When assigning values to multi-line fields such as transform or example, the best way to preserve whitespace and readability is to use YAML's |- multiline indicator as shown above.

Since this is a YAML “mapping”, the minimal specification (name only) would look like the following example.

zenpack.yaml
event_classes:
  /Status/Acme: {}

Event Class Fields

The following fields are valid for an event class entry.

NameDescriptionRequiredTypeDefault Value
pathPath to the Event Class (e.g. /Status/Acme). Must begin with “/”.yesstring(implied from key in event_classes map)
descriptionDescription of the event class.nostring"" (empty string)
createShould the event class be created when the ZenPack is installednobooleantrue
removeShould the event class be removed when the ZenPack is removed?
This will only apply to a ZenPack that has created the event class.
Any existing event classes not created by the ZenPack will not be removed.
Any event classes created by the platform will also never be removed.
nobooleanfalse
resetIf true, any zProperties defined here will override those of the target event class.nobooleanfalse
zPropertieszProperty values to set on the event class.nomap<name, value>{} (empty map)
transformA python block for transformation.nostring (multiline)"" (empty string)
mappingsEvent class mappings.nomap<name, Event Class Mapping>{} (empty map)

Event Class Mapping Fields

The following fields are valid for an event class mapping entry.

NameDescriptionRequiredTypeDefault Value
nameName of the event class mapping (e.g. WidgetDown).yesstring(implied from key in mappings map)
removeRemove the Mapping when the ZenPack is removed.nobooleanfalse
eventClassKeyEvent class key matched by the mapping.yesstringNone
ruleA python expression to match an event.nostring"" (empty string)
regexA regular expression to match an event.nostring"" (empty string)
exampleDebugging string to use in the regular expression UI testing.nostring (multiline)"" (empty string)
sequenceDefine the match priority. Lower is a higher priority.nointeger0
zPropertieszProperty values to set on the event class mapping.nomap<name, value>{} (empty map)
transformA python expression for transformation.nostring (multiline)"" (empty string)
explanationTextual description for matches of this event class mapping.
Use in conjunction with the Resolution field.
nostring (multiline)"" (empty string)
resolutionUse the Resolution field to enter resolution instructions for clearing the event.nostring (multiline)"" (empty string)