Page Comparison

...

The action block is the same as the action block in a rule. Any action, including a user-defined action, can be used in the action block. Actions can be simple or compound. A simple action is a valid action block. For example, the following defines an action called send_warning using the notify action event:send action:

send_warning = defaction(msg, eci) {
  notify(event:send({"eci":eci, "domain":"message", "type":"warning", "attrs": {"warning":"Warning!", + msg}});
}

Compound actions work the same as a rule. Suppose, for example, that in addition to putting up a notification, you wished to use send_directive:

send_warning = defaction(msg, eci) {

  every {
    notify("event:send({"eci":eci, "domain":"message", "type":"warning", "attrs": {"warning":"Warning!", + msg}});

    send_directive("a_warning_was_given") with
      message = msg
  }
}

...

,

...

send_warning = defaction(msg, transitory = false) {
  notify("Warning!", msg{"message":"msg"})
    with sticky = not transitory
}
}

The variable send_warning only has meaning in an action context within a rule. The following shows the use of send_warning and its optional parameter in the action of a rule:

if error_level > 12 && error_level < 15 then
  send_warning("Abnormal error levels")
    with transitory = true

Because user-defined actions are first-class values (i.e., they can be returned as the result of executing an expression), they can be passed into functions or other user-defined actions and returned as the result from a function. You can thus write recursive actions.