EMS Manual
Compiled Filters
EMS Manual—426909-005
5-40
Functions
Considerations
Use this function with caution. If possible, filtering should always be done by
tokens. Use the EMSTEXTMATCH function only if no other way is possible (for
example, for event messages that contain text instead of tokens). EMS is moving
toward using tokens instead of text in event messages. Using text increases
maintenance and reduces performance.
When you use EMSTEXTMATCH, you must consider errors that might occur when
the distributor calls EMSTEXT to generate the text needed for the pattern match
operation. Possibly the distributor will access a different set of event templates
than you expected, and therefore the text returned by EMSTEXT will be different
than you expected. This would occur if the operating system version (and thus the
content of the template file) changed between when the filter was written and when
it was executed.
Two cases in which the EMSTEXTMATCH function returns an error are:
When EMSTEXT returns an error
When TEXTMATCH fails
Example
If a text item in the event formatted according to init^template^key matches exactly the
text string in the parameter token, then pass this event message:
IF EMSTEXTMATCH (init^template^key, zvpt^fltr^eventtext) THEN
PASS
A TACL Macro "INSERTCOMMAS" can be used with EMSTEXTMATCH function
to avoid error regarding size of the map structure. The macro can be defined in
the following way:
[#DEF InsertCommas MACRO|BODY|[#DELTA /COMMANDS
ed^InsertCommas/%*%]]
[#DEF ed^InsertCommas DELTA|BODY|J<:S $;-DI,$>]
Example
EMSTEXTMATCH can be used in the following way with InsertCommas:
IF EMSTEXTMATCH
(([InsertCommas[zems^ddl^inittemplate]]),zems^tkn^text) THEN
PASS;