EMS Manual

Compiled Filters
EMS Manual—426909-005
5-35
Statements
DISCARDEVENT Statement
The DISCARDEVENT statement stops filter execution immediately and rejects the
current event message in any compiled filter, whether it is the only filter present or any
filter in a multiple-filter environment. Unlike the FAIL statement, DISCARDEVENT
rejects the message outright and does not pass it on to any other filters.
Example
This filter fragment makes use of a DISCARDEVENT statement and an implicit FAIL
statement:
.
.
.
IF fflag THEN DISCARDEVENT;
IF qflag THEN PASS;
-- If control reaches this point, an implicit FAIL
-- statement is executed.
END -- End of filter specification
FAIL Statement
The FAIL statement stops filter execution immediately and rejects the current event
message if the compiled filter is the only filter present or is the last filter in a multiple-
filter environment. In all other cases, the current event message is passed on to the
next filter within that collector or distributor. This strategy is different from that of the
DISCARDEVENT statement which, upon rejection of the current event message by the
filter, rejects the event message without passing it on to the next filter.
Considerations

If the last executable statement of the filter is executed without executing either a
PASS or FAIL statement, the event message is rejected. That is, a FAIL statement
is implicitly present as the last statement of the filter.
Example
This filter fragment makes use of both explicit and implicit FAIL statements:
.
.
.
DISCARDEVENT
FAIL