Extra Processors

Optional. You can use the extra processor property to chain two configuration files together. This property is useful if you need to use two or more different types of FlexConnectors for the same data. Extra processors are particularly useful when an event has more than one type of data in it and cannot be parsed by a single parser. This property is also referred to as parser linking.

Extra processor definition:

extraprocessor.count= <the number of extra processors>
#index start from 0
extraprocessor[<index>].type= <extra processor type>
extraprocessor[<index>].filename= <extra process file name>
extraprocessor[<index>].<extra processor variable>=
<extra processor parameter or conditional value>
…

This example illustrates properties that can be added to a time-based database FlexConnector, which cause it to invoke a Regex configuration file for further processing of the event.message:

extraprocessor.count=1
extraprocessor[0].type=regex
extraprocessor[0].filename=netiq/netiq
extraprocessor[0].field=event.message
extraprocessor[0].flexagent=true
extraprocessor[0].clearfieldafterparsing=false

One configuration file can link with many other configuration files (by setting the extraprocessor.count to a number greater than one). In addition, there is no limit to the number of configuration files, each containing one or more extraprocessor properties that can be chained together.

The following table lists the extra processor types you can specify.

Extra Processor Type	Description
delimited	For any of the delimited parsers
json	For JSON parsers
keyvalue	For key-value parsers
map	For a map file
ntsubparser	For supported Windows application parsers
regex	For any regular expression parsers
standardkeyvalue	For key-value parsers with “=” as the key-value separator and “,” as the key value pair separator
xml	For XML parsers

Except for the map extra processor configuration file, all extra processor configuration files should be placed in the \user\agent\flexagent folder. The map extra processor file should be placed in \user\agent\fcp or \user\agent\aup\fcp. If a map configuration file exists in both the paths, the one in \user\agent\aup\fcp overrides the one in \user\agent\fcp.

The following table lists the fields that can be used with an extra processor:

Field Name	Description
field	The value of this field is the input to the extra processor.
flexagent	true or false true: The connector uses the parsers in the flexagent directory. false: The connector uses the parsers in the fcp directory.
clearfieldafterparsing	Clear the input field after completion of parsing.
charencoding	Specifies the type of character encoding.
overrideeventmappings	true or false true: Override the mapping event field. false: Do not override the mapping event field.
conditionfield	Specifies the condition field the extra processor uses.
conditiontype	Specifies how the condition field relates to the condition values.
conditionvalues	Specifies condition values. Use commas to separate multiple values.
Casesensitive	true or false True = Use case sensitive parsing. False = Do not use case sensitive parsing.
concatenatevalues	true or false Applies to key-value parsers. If true and there is a duplicate key, do not override the value, but concatenate the values. If false and there is a duplicate key, override the value.