Update stream rule properties from input records. Only the fields a record carries are changed, and an empty value clears the field.

Input record:

• guid (required) - Target rule GUID
• name (optional) - Rule name. A duplicate name is rejected
• description (optional) - Free-text description
• msg (optional) - Event title template. $field inserts a log field value, e.g. SSH: $src_ip -> $dst_ip
• priority (optional) - LOW, MEDIUM or HIGH
• schema_code (optional) - Log schema code - the code field of sonar-log-schemas, e.g. session
• source_type (optional) - LOGGER or LOGGER_MODEL
• logger_guids (optional) - Logger GUIDs - a list, or a comma-separated string
• logger_model_guids (optional) - Logger model GUIDs - a list, or a comma-separated string
• category_guid (optional) - Category GUID
• ticket_repo_guid (optional) - Ticket repository GUID
• suppress_key (optional) - Suppression key template, e.g. $src_ip$dst_ip. One event per distinct combination
• event_suppress_interval (optional) - Event suppression window in seconds
• ticket_suppress_interval (optional) - Ticket suppression window in seconds
• keep_alive (optional) - true or false
• enabled (optional) - true or false

name, msg, priority, schema_code and source_type cannot be cleared. The rule body is not editable here - use sonar-insert/update/delete-stream-rule-command-batch for conditions.

run=VALUE

Optional. Update rule only if value is 't'

Output Fields