Date/time when phone started ringing.

Format: YYYY-mm-DD HH:MM:SS

Where:

• YYYY is a year
• mm is a month (1-12)
• DD is a day (1-31)
• HH is an hour (0-23)
• MM is a minute (0-59)
• SS is a second (0-59)

Example:

alerging-time = 2007-06-10 13:45:51

Date/time when call was answered.

Format: YYYY-mm-DD HH:MM:SS

Date/time when call was disconnected.

Format: YYYY-mm-DD HH:MM:SS

Duration of voice part of a call in seconds.

This is a difference between connect-time and disconnect-time.

Examples:

duration < 5

duration >= 30

Total duration of a call in seconds. This is a difference between setup time and disconnect time. Examples: 

total-duration < 5

Phase (state) of the call. It is a numeric value, one of:

• 0 - Idle
• 1 - Initiated. The first phase of a call: the caller sent invitation to the callee
• 2 - Accepted. The callee received invitation and confirmed this
• 3 - Alerting. The callee started ringing
• 4 - Connected. The call was answered
• 5 - Disconnecting. The call was initiated for disconnecting by one of  parties
• 6 - Disconnected. The call was completed (disconnected)
• 7 - Hold. The call was put on Hold
• 8 - Transferred. The call was transferred to the third party

Example:

call-state = 7

caller-ip

callee-ip

IP-address of caller/callee

Formats:

• x.x.x.x
• x.x.x.x/y.y.y.y
• x.x.x.x/z

where:

• x.x.x.x is ip-address
• y.y.y.y is a network mask in dot notation, like 255.255.255.0
• z is a network mask in CIRD notation (prefix length), like 24 (which is equivalent to 255.255.255.0).

Examples:

caller-ip = 192.168.0.1

caller-ip > 10.0.1.5 AND caller-ip < 10.0.1.20

callee-ip = 10.0.2.0/255.255.255.0

callee-ip = 10.0.2.0/24

caller-port

callee-port

IP port

Examples:

caller-port = 5060

caller-port = 1720 OR callee-port = 1720

caller-mac

callee-mac

MAC-address.

Format: XX-XX-XX-XX-XX-XX

Examples:

caller-mac = 01-02-34-56-AF-F5

caller-number

callee-number

Phone number

Examples:

caller-number = 123456

caller-number = '+100' OR callee-number = '+100'

caller-number LIKE '011%'

caller-name

callee-name

Name of phone.

The value of this parameter depends on the VoIP signaling protocol (SIP, H.323, Skinny, etc.).

Examples:

caller-name = "John Smith"

caller-name = "Marry" OR callee-name "Marry"

caller-id

callee-id

Id of phone.

The value of this parameter depends on the VoIP signaling protocol (SIP, H.323, Skinny, etc.).

Examples:

caller-id = user1@sip.example.com

caller-id = Phone41 OR callee-id = Phone41

agent-id

agent-name

Id and Name of Agent.

These parameters are available only when Avaya TSAPI integration is enabled.

Examples:

agent-id = 50001

agent-name = 'John Smith'

transfer-from-number

transfer-from-name

transfer-from-id

Number, name, and id of phone, from which the call was transferred.

The value of this parameter depends on the VoIP signaling protocol (SIP, H.323, Skinny, etc.).

Examples:

transfer-from-number = 123456

transfer-from-name = 'John Smith'

transfer-to-number

transfer-to-name

transfer-to-id

Number, name and id of phone, to which the call was transferred.

The value of this parameter depends on the VoIP, signaling protocol (SIP, H.323, Skinny etc.).

Examples:

transfer-to-number = 12456

transfer-to-name = 'John Smith'

Date/time when call was started

Format: YYYY-mm-DD HH:MM:SS

Where:

• YYYY is a year
• mm is a month (1-12)
• DD is a day (1-31)
• HH is an hour (0-23)
• MM is a minute (0-59)
• SS is a second (0-59)

Example:

setup-time = 2007-06-10 13:45:51

VoIP protocol of the call. It is a numeric value, one of:

• 0 – Unknown (not recognized protocol). Call is recorded from RTP packets
• 1 - SIP
• 2 - H.323
• 4 - SCCP (Cisco Skinny)
• 5 - MGCP
• 6 - Avaya (H.323 protocol with proprietary extensions)
• 7 - Nortel UNISTIM
• 8 - TAPI
• 9 - MGCP PRI Backhaul (it is used between Cisco CCM and Voice Gateway)
• 10 - Alcatel (proprietary protocol used by Alcatel OmniPCX)

Example:

voip-protocol <> 0

Value of specific SIP header inside INVITE message. The name of header is specified after hash (#) symbol.

Examples:

sip-header-invite#User-Agent LIKE "Asterisk%"

=

==

caller-ip = 192.168.0.1

callee-port == 5060

<>

!=

caller-ip <> 10.0.0.1

callee-port != 5060 

>

caller-ip > 10.0.0.10

<

caller-port < 3000

>=

caller-ip >= 192.168.0.1

<=

caller-ip <= 192.168.0.50

LIKE

caller-ip LIKE '192.168.0.%'

NOT LIKE

caller-number NOT LIKE '011%'

RLIKE

caller-number RLIKE '^011(22|34).*$'

NOT RLIKE

caller-ip NOT RLIKE '^192\.168\.(0|1)\..*$'

AND

&&

caller-ip=192.168.0.1 AND caller-port=5060

caller-ip=10.0.0.1 && callee-ip=10.0.0.20

NOT

!

NOT (caller-port > 1024 AND caller-port < 6000)

! (caller-port < 1024 OR caller-port > 6000)

OR

||

caller-ip=10.0.0.1 OR callee-ip=10.0.0.1

caller-ip=10.0.0.1 || callee-ip=10.0.0.1

Matches any number of characters, even zero characters

Examples:

• caller-name LIKE 'David%'

  ... will match David, Davidson, but not Davi

• caller-name LIKE 'D%d%'

  ... will match David, Davidson, Dady

Matches exactly one character

Examples:

• caller-name LIKE 'D_vi_'

  ... will match David, but not Davidson

• caller-name LIKE 'D__vi_'

  ... will match Daavid, but not David

\%

Matches exactly one '%' character

• caller-name LIKE 'David\%'

  ... will match David%

\_

Matches exactly one '_' character

• caller-name LIKE 'David\_'

  ... will match David_

\\

Matches exactly one '\' character

• caller-name LIKE 'David\\'

  ... will match David\

Matches any single character. For example:

• a.c

  ... will match  "abc", but not "ac" or "abbc"

A bracket expression. Matches a single character that is contained within the brackets. For example:

• [abc]

  ... will match "a", "b" or "c".

• [hc]at

  ... will match "hat" and "cat".

A '-' character between two other characters forms a range that matches all characters from the first character to the second. For example:

• [0-9]

  ... will match any decimal digit.

• [a-z]

  ... will match any lowercase letter from "a" to "z".

These forms can be mixed:

• [abcx-z]

  ... will match "a", "b", "c", "x", "y" or "z".

To include a literal '-' character, it must be written first or last, for example, [abc-], [-abc].

To include a literal ] character, it must immediately follow the opening bracket [, for example, []abc].

Matches a single character that is not contained within the brackets. For example:

• [^abc]

  ... will match any character other than "a", "b", or "c".

• [^a-z]

  ... will match any single character that is not a lowercase letter from "a" to "z".

As above, literal characters and ranges can be mixed, like [^abcx-z]

Matches the preceding element zero or more times. For example:

• ab*c

  ... will match "ac", "abc", "abbbc" etc.

• [0-9]*

  ... will match "" (empty string), "0", "1", "2", "14", "502", "98541654", and so on (any combination of digits).

Matches zero of more instances of the characters sequence, specified inside parentheses. For example:

• (ab)*

  ... will match "", "ab", "abab", "ababab", and so on.

• (1234)*

  ... will match "", "1234", "12341234", "123412341234", and so on.

Matches the preceding element one or more times. For example:

• ba+

  ... will match "ba", "baa", "baaa", and so on.

• 0[0-9]+

  ... will match "00", "01", "02", "001", "01234", "09876543210", or any other combination of digits with preceding 0 and minimum length equal to two character.

Matches the preceding element zero or one time. For example:

• ba?

  ... will match "b", or "ba", but not "baa"

• 0[0-9]?

  ... will match "0", "01", "02", "03", and so on.

The choice (aka alternation or set union) operator matches either the expression before or the expression after the operator. For example:

• abc|def

  ... will match "abc" or "def".

• (0|011)[1-9]+

  ... will match phone number, which starts with either 0 or 011.

Matches the preceding element exactly n times. For example: 

• a{3}

  ... will match "aaa", but not "a", "aa" or "aaaa"

• [0-9]{5}

  ... will match "01234", "56789" or any other combination of digits, which has length 5 characters.

Matches the preceding element at least m and not more than n times. For example:

• a{3,5}

  ... will match "aaa", "aaaa", "aaaaa", but not "aa" or "aaaaaaaa".

Matches the preceding element at least m times. For example:

• a{2,}

  ... will match "aa", "aaa", "aaaa", and so on.

Matches the beginning of a string. For example:

• ^[hc]at

  ... will match "hat" and "cat", but only at the beginning of the string

Matches the end of a string. For example:

• [hc]at$

  ... will match "hat" and "cat", but only at the end of the string not "David Bowie"

• ^[hc]at$

  ... will match "hat" and "cat", but only when the string contains no other characters

Backslash (\) character is used for escaping metacharacters. For example:

• 1+2

  ... will match "12", "112", "11112", but not "1+2", because "plus" character has a special meaning (see above).

• 1\+2

  ... will match exactly "1+2". In this example, the "plus" character is escaped with the backslash character (\+).