attributeAlias element

The <attributeAlias> element provides an alias name to associate event attributes that have the same meaning but different names in different events. For example, three different events might use these three different names for an event attribute that indicates the name of the system that originates the event: host, hostname, and source. The <attributeAlias> element contains the <eventAttribute> elements that describe the individual event attributes that must be associated as one event attribute for the grouping key.

Details

The <attributeAlias> element and its aliasName attribute are valid only in the context of a grouping key. This element and its attribute cannot be referenced in any expression, including an expression within the <computedValue> element.

Attributes

<attributeAlias> has the following attribute:

Table 1. Attributes of the <attributeAlias> element
Name Description Data type Required?
aliasName Defines the name for the event attributes that are described in the <eventAttribute> elements and are to be associated as one event attribute for the grouping key. This name must be unique within the rule. xsd:NMTOKEN Yes

Contained within

<attributeAlias> is contained within the following element:

Contains

<attributeAlias> contains the following element:

Table 2. Elements contained within the <attributeAlias> element
Element Required or optional?
<eventAttribute> 2 occurrences of this element are required. Additional occurrences are allowed.