Table of Contents
> Correlation object 关联对象
The following objects are directly related to the correlation API. 以下对象与“相关”API直接相关。
Correlation关联
The correlation object has the following properties.相关对象具有以下属性。
| 属性 类 | 说明 | |
|---|---|---|
| correlationid | string | (readonly) ID of the correlation. 关联的ID。 |
| name (required) |
string | Name of the correlation. 关联的名称。 |
| description | string | Description of the correlation.关联的说明 |
| status | integer | Whether the correlation is enabled or disabled.关联是否被启用 Possible values are: 可能的值是： 0 - (default)默认 enabled;启用 1 - disabled.禁用 |
Correlation operation 关联操作
The correlation operation object defines an operation that will be performed when a correlation is executed. It has the following properties.相关操作对象定义当执行相关时将执行的操作。 它具有以下属性。
| 属性 类 | 说明 | |
|---|---|---|
| type (required) |
integer | Type of operation. 操作类型 Possible values: 可能的值是： 0 - close old events;关闭旧事件 1 - close new event。关闭新事件 |
Correlation filter关联筛选
The correlation filter object defines a set of conditions that must be met to perform the configured correlation operations. It has the following properties.相关性过滤器对象定义了一组必须满足的条件来执行配置的相关操作。 它具有以下属性。
| 属性 类 | 说明 | |
|---|---|---|
| evaltype (required) |
integer | Filter condition evaluation method. 过滤条件评估方法。 Possible values:可能的值： 0 - and/or;与/或 1 - and; 与 2 - or;或 3 - custom expression. 自定义表达式 |
| conditions (required) |
array | Set of filter conditions to use for filtering results.用于过滤结果的一组过滤条件。 |
| eval_formula | string | (readonly) Generated expression that will be used for evaluating filter conditions. The expression contains IDs that reference specific filter conditions by its formulaid. The value of eval_formula is equal to the value of formula for filters with a custom expression. 生成的表达式将用于评估过滤条件。该表达式包含通过其“公式”引用特定过滤条件的ID。“eval_formula”的值等于具有自定义表达式的过滤器的“公式”值。 |
| formula | string | User-defined expression to be used for evaluating conditions of filters with a custom expression. The expression must contain IDs that reference specific filter conditions by its formulaid. The IDs used in the expression must exactly match the ones defined in the filter conditions: no condition can remain unused or omitted.用于自定义表达式用于评估过滤条件的用户定义表达式。表达式必须包含通过其''公式'引用特定过滤条件的ID。表达式中使用的ID必须与过滤条件中定义的ID完全匹配：无条件可以保留未使用或省略。Required for custom expression filters. 需要自定义表达式过滤器。 |
Correlation filter condition关联过滤条件
The correlation filter condition object defines a specific condition that must be checked before running the correlation operations.相关滤波条件对象定义在运行相关运算之前必须检查的特定条件。
| 属性 类 | 说明 | |
|---|---|---|
| type (required) |
integer | Type of condition. 条件类型 Possible values:可能的值： 0 - old event tag; 旧事件标签 1 - new event tag;新事件标签 2 - new event host group; 新事件主机组; 3 - event tag pair;事件标签对 4 - old event tag value;旧事件标签值; 5 - new event tag value.新的事件标签值。 |
| tag | string | Event tag (old or new). Required when type of condition is: 0, 1, 4, 5.事件标签（旧的或新的）。 条件类型为0，1，4，5时需要。 |
| groupid | string | Host group ID. Required when type of condition is: 2. 主机组ID。 条件类型是必需的：2。 |
| oldtag | string | Old event tag. Required when type of condition is: 3.旧事件标签 条件类型为3时需要。 |
| newtag | string | Old event tag. Required when type of condition is: 3.旧事件标签 条件类型为3时需要。 |
| value | string | Event tag (old or new) value. Required when type of condition is: 4, 5.事件标签（旧或新）值。 条件类型：4,5时需要。 |
| formulaid | string | Arbitrary unique ID that is used to reference the condition from a custom expression. Can only contain capital-case letters. The ID must be defined by the user when modifying filter conditions, but will be generated anew when requesting them afterward. 用于从自定义表达式引用条件的任意唯一ID。只能包含大写字母。修改过滤条件时，用户必须定义ID，但是以后请求时会重新生成。 |
| operator | integer | Condition operator.条件运算符。 Required when type of condition is: 2, 4, 5.条件类型为2，4，5时需要。 |
To better understand how to use filters with various types of expressions, see examples on the correlation.get and correlation.create method pages.要更好地了解如何使用具有各种类型表达式的过滤器，请参阅correlation.get和correlation.create方法页面上的示例。
The following operators and values are supported for each condition type.每个条件类型都支持以下运算符和值。
| 条件 条 | 名称 Suppo | ted operators支持的运算符 Expected va | ue期望值 |
|---|---|---|---|
| 2 | Host group | =, <> | Host group ID.主机组ID。 |
| 4 | Old event tag value | =, <>, like, not like | string字符串 |
| 5 | New event tag value | =, <>, like, not like | string 字符串 |