Grouping related fields with FFlist and Gflist

The FFlist Format specification and the GFlist Get specification might be used to control the grouping of related fields, especially repeating fields. This section is not the definitive description of FFlist and GFlist; for the formal syntax see Format-specifications and Get-specifications.

For the purposes of this discussion assume an event type defined as TSample. Assume that the event records contain a repeating section based on a triplet at offset 28. Assume the sections consist of two 8-byte fields, a first name and a last name. Assume OPTIONS SIEMTYPE(RFC3164) and that OPTIONS DELIMIT() has been allowed to default.

Assume an event record with three such sections:

Joelle	Faucher
Vince	Hammond
Charles	Mills

If you define the fields in the most obvious fashion as the following:

DEF FIRST First TSample() FChar(8) GTriplet(28 0)
DEF LAST Last TSample() FChar(8) GTriplet(28 8)

and then code FIELDS(... FIRST LAST ...) for the event in the parameter file, the preceding event record would format as the following:

First: Joelle – First: Vince – First: Charles – Last: Faucher – Last: Hammond – Last: Mills –

This formatting is not an ideal one. You might say that the first and last name fields are not properly grouped, and that triplet repetition has occurred at the individual field level rather than at the section level.

You can solve that problem through the use of FFlist and GFlist. If you define the fields as the following:

DEF FIRST First TSample() FChar(8) GFlist(0)
DEF LAST Last TSample() FChar(8) GFlist(8)
DEF NAME Name TSample() FFlist(Inner FIRST LAST) GTriplet(28 0)

and then code FIELDS(... NAME ...) for the event in the parameter file (note the use of GFlist and FFlist(Inner ...)), then the preceding event record would format as the following:

Name: {First: Joelle – Last: Faucher} - Name: {First: Vince – Last: Hammond} – Name: {First: Charles – Last: Mills}

This is an improvement.

Note

The first and last names are grouped and triplet repetition has occurred at that group level.

If you wish to format each section as Name: Last, First. You can define the fields as the following:

DEF MYDELIM '' TSample() FChar(2 TB) GConst(', ')
DEF FIRST '' TSample() FChar(8) GFlist(0)
DEF LAST '' TSample() FChar(8) GFlist(8)
DEF NAME Name TSample() FFlist(None LAST MYDELIM FIRST) + GTriplet(28 0)

Note

The definition of MYDELIM as a constant ' , ', the use of FChar(TB) to preserve the trailing blank, and the use of null ('') tags and FFlist(None ...).

The record now formats as the following:

Name: Faucher, Joelle - Name: Hammond, Vince – Name: Mills, Charles

The fields FIRST and LAST have no identifying tags. You might want to prevent users from referencing them in a parameter file FIELDS() operand because the lack of tags could be confusing if the fields are used on their own outside of NAME. To do so, code NOPARM() in the context parameter of DEF. Refer the following example:

DEF MYDELIM '' Sample(NOPARM()) FChar(2 TB) GConst(', ')
DEF FIRST '' Sample(NOPARM()) FChar(8) GFlist(0)
DEF LAST '' Sample(NOPARM()) FChar(8) GFlist(8)
DEF NAME Name Sample() FFlist(None LAST MYDELIM FIRST) +
GTriplet(28 0)

There is no difference in the formatted message.

If you need to format the names as an array, like in the following instance:

Names: [Faucher, Joelle - Hammond, Vince – Mills, Charles]

All that is necessary is to add ARRAY() to the context parameter of the NAME field, and change the tag to Names. See the following example:

DEF NAME Names Sample(ARRAY()) FFlist(None LAST MYDELIM FIRST) + GTriplet(28 0)

Grouping related fields with FFlist and Gflist

On this page