Rewriting of messages
Last updated: September 11. 2012
The Event Console can change messages on the fly. This allows you to replace cryptic error messages with more useful descriptions. It also can be used to attach comments and contact information to the created events:
Again the match group comes in very handy. In the example in our screenshot the pattern FOO-4711 error at (.*) bar contains the placeholder (.*). What ever text appears at the place in the original message will be saved in the match group #1. The actual text of this group can then be inserted in all four rewriting parameters by writing \1.
1.1. Rewriting and cancelling
When you use rewriting in rules that use cancelling at the same time then you need to keep an eye on rewriting hostname and/or application. When the cancelling algorithm tries to match an existing event, it always needs to make sure that the "OK"-message does have the same hostname and application as the original problem message. But if the hostname has been rewritten, this matching would never work if the original unrewritten hostname would be used for matching.
Therefore when trying cancelling the Event Console simulates a rewriting of hostname and application according the rule in question before trying the cancelling match. This is usually what you would expect anyway.
This behaviour also can help in the case that the application field of a problem message and its later cancelling message do not match. Simply rewrite the application to some known trivial value in order to effectively ignore it while cancelling.