Syntax of recording filter condition

Syntax

Condition of recording filter has following syntax:

[ NOT ]  EXPRESSION  [ AND | OR ] [ ( ] EXPRESSION [ ) ] ...

Where, EXPRESSION is:

CALL-PARAMETER  [ = | > | >= | < | <= | <> | != | LIKE | RLIKE ]  [ VALUE | CALL-PARAMETER ]

CALL-PARAMETER is a call parameter, like caller-ip, caller-number, duration etc.
VALUE is a literal value, to which a call parameter is compared, for example, 1234, "Jonh Smith" etc.
\=, >, >=, <, <=, <>, !=, LIKE and RLIKE are comparison operators.

Examples of recording filter condition:

caller-ip = 192.168.0.1

caller-number = 1234 OR caller-number = 5678

caller-ip = 10.0.0.0/24 AND NOT callee-ip = 192.168.1.2

(caller-number = 100 OR caller-number = 200) AND callee-number <> 300

caller-number LIKE '011%'

caller-number RLIKE '^011(22|34).*$'

Call parameters

The following table lists all supported call parameters.

Call parameter Description

caller-ip

callee-ip

IP-address of caller/callee

Formats:

x.x.x.x
x.x.x.x/y.y.y.y
x.x.x.x/z

where:

x.x.x.x is ip-address
y.y.y.y is a network mask in dot notation, like 255.255.255.0
z is a network mask in CIRD notation (prefix length), like 24 (which is equivalent to 255.255.255.0).

Examples:

caller-ip = 192.168.0.1

caller-ip > 10.0.1.5 AND caller-ip < 10.0.1.20

callee-ip = 10.0.2.0/255.255.255.0

callee-ip = 10.0.2.0/24

caller-port

callee-port

IP port

Examples:

caller-port = 5060

caller-port = 1720 OR callee-port = 1720

caller-mac

callee-mac

MAC-address.

Format: XX-XX-XX-XX-XX-XX

Examples:

caller-mac = 01-02-34-56-AF-F5

caller-number

callee-number

Phone number

Examples:

caller-number = 123456

caller-number = '+100' OR callee-number = '+100'

caller-number LIKE '011%'

caller-name

callee-name

Name of phone.

The value of this parameter depends on voip signaling protocol (SIP, H.323, Skinny etc).

Examples:

caller-name = "John Smith"

caller-name = "Marry" OR callee-name "Marry"

caller-id

callee-id

Id of phone.

The value of this parameter depends on voip signaling protocol (SIP, H.323, Skinny etc).

Examples:

caller-id = user1@sip.example.com

caller-id = Phone41 OR callee-id = Phone41

agent-id

agent-name

Id and Name of Agent.

These parameters are available only when Avaya TSAPI integration is enabled.

Examples:

agent-id = 50001

agent-name = 'John Smith'

transfer-from-number

transfer-from-name

transfer-from-id

Number, name and id of phone, from which the call was transferred.

The value of this parameter depends on voip signaling protocol (SIP, H.323, Skinny etc).

Examples:

transfer-from-number = 123456

transfer-from-name = 'John Smith'

transfer-to-number

transfer-to-name

transfer-to-id

Number, name and id of phone, to which the call was transferred.

The value of this parameter depends on voip signaling protocol (SIP, H.323, Skinny etc).

Examples:

transfer-to-number = 12456

transfer-to-name = 'John Smith'

setup-time

Date/time when call was started

Format: YYYY-mm-DD HH:MM:SS

Where:

YYYY is a year
mm is a month (1-12)
DD is a day (1-31)
HH is an hour (0-23)
MM is a minute (0-59)
SS is a second (0-59)

Example:

setup-time = 2007-06-10 13:45:51

voip-protocol

Voip protocol of the call. It is a numeric value, one of:

0 – Unknown (not recognized protocol). Call is recorded from RTP packets
1 - SIP
2 - H.323
4 - SCCP (Cisco Skinny)
5 - MGCP
6 - Avaya (H.323 protocol with proprietary extensions)
7 - Nortel UNISTIM
8 - TAPI
9 - MGCP PRI Backhaul (it is used between Cisco CCM and Voice Gateway)
10 - Alcatel (proprietary protocol used by Alcatel OmniPCX)

Example:

voip-protocol <> 0

sip-header-invite

Value of specific SIP header inside INVITE message. The name of header is specified after hash (#) symbol.

Examples:

sip-header-invite#User-Agent LIKE "Asterisk%"

Call parameters can be compared to literal values or to other call parameters, like:

caller-ip = 10.0.0.1
caller-port = callee-port

Literal values

Literal values are contacts, which are compared to call parameters.

Example:

caller-number = '123456789'

In above example a literal value '123456789' is compared to call parameter caller-number.

If a literal value contains space characters, then it should be enclosed into single (') or double (") quotes. For example:

caller-number = 123456789            <-- OK

caller-number = '123456789'          <-- OK

caller-name   = "John Smith"         <-- OK

caller-name   = John Smith           <-- Not valid

If a literal value itself contains a quote character, for example, d’Arnaud, then use following rules:

If a literal value contains either a single or double quote character, but not both at the same time, then enclose the value into different quotes, like:
```
caller-name = "d'Arnaud"

caller-name = 'Using double quotes charcter (")'
```
If a literal value contains both single and double quote characters, precede them with a special escape character ‘\’, like:
```
caller-name = 'd\'Arnaud'

caller-name = "Using double quotes charcter (\")"
```
If a literal value contains escape character '\', you must double it, like:
```
caller-name = "Sample \\ name"
```

Comparison operators (=, >, < etc)

The following table lists all supported comparison operators.

Operator	Description	Examples
= ==	Equal to	`caller-ip = 192.168.0.1` `callee-port == 5060`
<> !=	Not equal to	`caller-ip <> 10.0.0.1` `callee-port != 5060`
>	Greater than	`caller-ip > 10.0.0.10`
<	Less than	`caller-port < 3000`
>=	Greaten than or equal to	`caller-ip >= 192.168.0.1`
<=	Less than or equal to	`caller-ip <= 192.168.0.50`
LIKE	Simple pattern matching	`caller-ip LIKE '192.168.0.%'`
NOT LIKE	Negation of simple pattern matching	`caller-number NOT LIKE '011%'`
RLIKE	Pattern matching using regular expressions (REGEX)	`caller-number RLIKE '^011(22`
NOT RLIKE	Negation of Pattern matching using regular expressions (REGEX)	`caller-ip NOT RLIKE '^192.168.(0`

Logical opertors (AND, OR, NOT)

Complex expessions can be created with the help of logical operators (AND, OR, NOT etc).

Operator Description Examples

AND

&&

Logical AND

caller-ip=192.168.0.1 AND caller-port=5060

caller-ip=10.0.0.1 && callee-ip=10.0.0.20

NOT

!

Negates value

NOT (caller-port > 1024 AND caller-port < 6000)

! (caller-port < 1024 OR caller-port > 6000)

OR

Prentheses "(" and ")" are supported inside expressions, like:

caller-ip=192.168.0.1 AND ( callee-ip = 10.0.0.1/24 OR callee-ip = 80.25.23.10 )

Simple pattern matching (LIKE)

Pattern matching comparison supports following wildcard characters:

Character Description

%

Matches any number of characters, even zero characters

Examples:

```
caller-name LIKE 'David%'
```
... will match David, Davidson, but not Davi
```
caller-name LIKE 'D%d%'
```
... will match David, Davidson, Dady

_

Matches exactly one character

Examples:

```
caller-name LIKE 'D_vi_'
```
... will match David, but not Davidson
```
caller-name LIKE 'D__vi_'
```
... will match Daavid, but not David

To test for literal instances of a wildcard character, precede it by the escape character '\'.

String Description

\%

Matches exactly one '%' character

```
caller-name LIKE 'David\%'
```
... will match David%

\_

Matches exactly one '' character

```
caller-name LIKE 'David_'
```
... will match David

\\

Matches exactly one '\' character

```
caller-name LIKE 'David\'
```
... will match David\

Regular expressions pattern matching (RLIKE)

A regular expression is a powerful way of specifying a pattern for a complex search.

Examples:

callee-number RLIKE '^011(22|34).*$'

... will match any call, which was made to phone number starting either with 01122 or 01134

caller-ip NOT RLIKE '^192\.168\.(0|1)\..*$'

... will match any call, which was originated from IP 192.168.0.* or 192.168.1.*

MiaRec uses Henry Spencer's implementation of regular expressions, which is aimed at conformance with POSIX 1003.2.

Metacharacters

A regular expression for the RLIKE operator may use any of the following metacharacters and constructs:

Metacharacter	Description
.	Matches any single character. For example: `a.c` ... will match "abc", but not "ac" or "abbc"
[ ]	A bracket expression. Matches a single character that is contained within the brackets. For example: `[abc]` ... will match "a", "b" or "c". `[hc]at` ... will match "hat" and "cat". A '-' character between two other characters forms a range that matches all characters from the first character to the second. For example: `[0-9]` ... will match any decimal digit. `[a-z]` ... will match any lowercase letter from "a" to "z". These forms can be mixed: `[abcx-z]` ... will match "a", "b", "c", "x", "y" or "z". To include a literal '-' character, it must be written first or last, for example, [abc-], [-abc]. To include a literal ] character, it must immediately follow the opening bracket [, for example, []abc].
[^ ]	Matches a single character that is not contained within the brackets. For example: `[^abc]` ... will match any character other than "a", "b", or "c". `[^a-z]` ... will match any single character that is not a lowercase letter from "a" to "z". As above, literal characters and ranges can be mixed, like [^abcx-z]
*	Matches the preceding element zero or more times. For example: `abc` ... will match "ac", "abc", "abbbc" etc. `[0-9]` ... will match "" (empty string), "0", "1", "2", "14", "502", "98541654", and so on (any combination of digits).
( )*	Matches zero of more instances of the characters sequence, specified inside parentheses. For example: `(ab)` ... will match "", "ab", "abab", "ababab", and so on. `(1234)` ... will match "", "1234", "12341234", "123412341234", and so on.
+	Matches the preceding element one or more times. For example: `ba+` ... will match "ba", "baa", "baaa", and so on. `0[0-9]+` ... will match "00", "01", "02", "001", "01234", "09876543210", or any other combination of digits with preceding 0 and minimum length equal to two character.
?	Matches the preceding element zero or one time. For example: `ba?` ... will match "b", or "ba", but not "baa" `0[0-9]?` ... will match "0", "01", "02", "03", and so on.
\|	The choice (aka alternation or set union) operator matches either the expression before or the expression after the operator. For example: `abc\|def` ... will match "abc" or "def". `(0\|011)[1-9]+` ... will match phone number, which starts with either 0 or 011.
{n}	Matches the preceding element exactly n times. For example: `a{3}` ... will match "aaa", but not "a", "aa" or "aaaa" `[0-9]{5}` ... will match "01234", "56789" or any other combination of digits, which has lenght 5 characters.
{m, n}	Matches the preceding element at least m and not more than n times. For example: `a{3,5}` ... will match "aaa", "aaaa", "aaaaa", but not "aa" or "aaaaaaaa".
{m, }	Matches the preceding element at least m times. For example: `a{2,}` ... will match "aa", "aaa", "aaaa", and so on.
^	Matches the beginning of a string. For example: `^[hc]at` ... will match "hat" and "cat", but only at the beginning of the string
$	Matches the end of a string. For example: `[hc]at$` ... will match "hat" and "cat", but only at the end of the string not "David Bowie" `^[hc]at$` ... will match "hat" and "cat", but only when the string contains no other characters
\	Backslash () character is used for escaping metacharacters. For example: `1+2` ... will match "12", "112", "11112", but not "1+2", because "plus" character has a special meaning (see above). `1\+2` ... will match exactly "1+2". In this example, "plus" character is escaped with backslash character (\+).

POSIX character classes

The POSIX standard defines some classes or categories as shown in the following table

POSIX character class	ASCII equivalent	Description
[:alnum:]	`[A-Za-z0-9]`	Alphanumeric characters
[:alpha:]	`[A-Za-z]`	Alphabetic characters
[:blank:]	`[ \t]`	Space and tab
[:cntrl:]	`[\x00-\x1F\x7F]`	Control characters
[:digit:]	`[0-9]`	Digits
[:graph:]	`[\x21-\x7E]`	Visible characters
[:lower:]	`[a-z]`	Lowercase letters
[:print:]	`[\x20-\x7E]`	Visible characters and spaces
[:punct:]	[]\[!"#$%&'()\*+,./:;<=>?@\\^\_\``{\\|}\~-]	Punctuation characters
[:space:]	`[ \t\r\n\v\f]`	Whitespace characters
[:upper:]	`[A-Z]`	Uppercase letters
[:xdigit:]	`[A-Fa-f0-9]`	Hexadecimal digits

POSIX character classes can only be used within bracket expressions ([ ]). For example:

 [[:upper:]ab]

... will match the uppercase letters and lowercase "a" and "b".

Testing REGEX

Writing a correct REGEX expression may be a challenging task. We recommend to use a special site for testing RLIKE expressions for any syntax errors.