> Correlation object

The following objects are directly related to the correlation API.

Correlation

The correlation object has the following properties.

PropertyTypeDescription
correlationidstring(readonly) ID of the correlation.
name
(required)
stringName of the correlation.
descriptionstringDescription of the correlation.
statusintegerWhether the correlation is enabled or disabled.

Possible values are:
0 - (default) enabled;
1 - disabled.

Correlation operation

The correlation operation object defines an operation that will be performed when a correlation is executed. It has the following properties.

PropertyTypeDescription
type
(required)
integerType of operation.

Possible values:
0 - close old events;
1 - close new event.

Correlation filter

The correlation filter object defines a set of conditions that must be met to perform the configured correlation operations. It has the following properties.

PropertyTypeDescription
evaltype
(required)
integerFilter condition evaluation method.

Possible values:
0 - and/or;
1 - and;
2 - or;
3 - custom expression.
conditions
(required)
arraySet of filter conditions to use for filtering results.
eval_formulastring(readonly) Generated expression that will be used for evaluating filter conditions. The expression contains IDs that reference specific filter conditions by its formulaid. The value of eval_formula is equal to the value of formula for filters with a custom expression.
formulastringUser-defined expression to be used for evaluating conditions of filters with a custom expression. The expression must contain IDs that reference specific filter conditions by its formulaid. The IDs used in the expression must exactly match the ones defined in the filter conditions: no condition can remain unused or omitted.

Required for custom expression filters.

Correlation filter condition

The correlation filter condition object defines a specific condition that must be checked before running the correlation operations.

PropertyTypeDescription
type
(required)
integerType of condition.

Possible values:
0 - old event tag;
1 - new event tag;
2 - new event host group;
3 - event tag pair;
4 - old event tag value;
5 - new event tag value.
tagstringEvent tag (old or new). Required when type of condition is: 0, 1, 4, 5.
groupidstringHost group ID. Required when type of condition is: 2.
oldtagstringOld event tag. Required when type of condition is: 3.
newtagstringOld event tag. Required when type of condition is: 3.
valuestringEvent tag (old or new) value. Required when type of condition is: 4, 5.
formulaidstringArbitrary unique ID that is used to reference the condition from a custom expression. Can only contain capital-case letters. The ID must be defined by the user when modifying filter conditions, but will be generated anew when requesting them afterward.
operatorintegerCondition operator.

Required when type of condition is: 2, 4, 5.

To better understand how to use filters with various types of expressions, see examples on the correlation.get and correlation.create method pages.

The following operators and values are supported for each condition type.

ConditionCondition nameSupported operatorsExpected value
2Host group=, <>Host group ID.
4Old event tag value=, <>, like, not likestring
5New event tag value=, <>, like, not likestring