I'm trying to create an ESA rule, based on a list. The problem is that the ip_dstport is in integer and not in string, and the auto conversion is forbidden. Anyone knows a way to convert the ip_dstport in string inside the rule?
It sounds like the cast function should work for you.
Esper Reference 10.1.2. The Cast Function
Thank you. It worked! For other people that have the same question, here's the function working:
EXISTS (SELECT * FROM $Table WHERE (LIST = cast(Event.ip_dstport, string)))
Retrieving data ...