The current implementation only allows to have a common message format and a set of destinations, for all the alarms that that match the supplied list of UEIs if exist, in order to forward the alarm as Syslog message.

I think that adding filtering capabilities, and the ability to change the message format per destination will make the syslog northbound interface more powerful and a lot more flexible.

That being said, the structure of syslog-northbounder-configuration.xml has to be changed. The idea is enhance the current structure to introduce the new features while preserving compatibility with the old structure.

We can introduce another main tag called filter. This tag is going to have the following attributes:

1. A boolean flag to specify if the filter is enabled

2. A name for the filter

3. A filter rule, which should be a SPEL expression built against the NorthboundAlarm class. The incoming northbound alarms have to match the filter in order to be forwarded.

4. An optional message-format. If it is supplied, it will be used as the format for the target message. Otherwise, the default message-format defined inside the syslog-northbounder-config will be used.

5. A destination name, the name of the configured destination to be used as a target for the Syslog message.

With this in mind, the new configuration is completely compatible with older versions of OpenNMS, and provides the ability to be fully customizable in order to have custom filters with multiple destination and target formats.

Example:

syslog-northbounder-config.xml

About the example:

• There are no external UEI list, so the northbounder will match all the alarms.

• There are 3 destination and 3 filters.

• Each filter is associated with a particular destination.

• The first two filters are going to share the default message format.

• The third filter is going to have a custom format for the message (to show the functionality).

• The third filter is disabled (to show the functionality).

• All the rules are based on the content of a particular event parameter.

• The incoming alarm can match multiple filters.

• The syslog message will be sent if the filter is enabled and the rule is satisfied.

Because the filter rule will be parsed using SPEL it can be more elaborated and complex if needed.

Backword compatibility

If there are filters defined, they will determine the behavior of the syslog northbounder (even if they are disabled). Otherwise, it will work as it used to (i.e. filtering based on UEIs with multiple destination and a shared message format).