#NEWLINE# def get_match_str( self , match ) : #NEWLINE# #INDENT# lt = self . rules . get ( 'use_local_time' ) #NEWLINE# starttime = pretty_ts ( dt_to_ts ( ( ts_to_dt ( match [ self . ts_field ] ) - self . rules [ 'timeframe' ] ) ) , lt ) #NEWLINE# endtime = pretty_ts ( match [ self . ts_field ] , lt ) #NEWLINE# message = ( 'At least %d events occurred between %s and %s\n\n' % ( self . rules [ 'num_events' ] , starttime , endtime ) ) #NEWLINE# return message