Event Rule Regex parse value from JSON values

[Community Alums]

Hello,

could someone help me figure out how to grab the value of the red text? I am having a hard time creating a regex for Event Rule.

I wanted to extract the value of the key <dt.event.source>= A19146.test.ca

{"key":"dt.event.group_label","value":"Availability"},{"key":"dt.event.impact_level","value":"Infrastructure"},{"key":"dt.event.is_rootcause_relevant","value":"true"},{"key":"dt.event.preferred_entity_type","value":"os:service"},{"key":"dt.event.source","value":"AI9146.test.ca"},{"key":"dt.event.timeout","value":"5"},{"key":"dt.event.title","value":"World Wide Web Publishing Service is in undesirable (running) state"},{"key":"dt.host_group.id","value":"safasdfasf"},{"key":"dt.osservice.display_name","value":"asdfasdfasdf"},{"key":"dt.osservice.name","value":"W3SVC"},{"key":"host.name","value":"AI9146.test.ca"}]}

[Najmuddin Mohd]

Hi @Community Alums ,
Can you try the below one.

var data = '[{"key":"dt.event.group_label","value":"Availability"},{"key":"dt.event.impact_level","value":"Infrastructure"},{"key":"dt.event.is_rootcause_relevant","value":"true"},{"key":"dt.event.preferred_entity_type","value":"os:service"},{"key":"dt.event.source","value":"AI9146.test.ca"},{"key":"dt.event.timeout","value":"5"},{"key":"dt.event.title","value":"World Wide Web Publishing Service is in undesirable (running) state"},{"key":"dt.host_group.id","value":"safasdfasf"},{"key":"dt.osservice.display_name","value":"asdfasdfasdf"},{"key":"dt.osservice.name","value":"W3SVC"},{"key":"host.name","value":"AI9146.test.ca"}]';

// Regular expression to find the "key": "dt.event.source" and capture the value
var regex = /"key":"dt\.event\.source","value":"([^"]+)"/;

// Apply the regex
var match = data.match(regex);

// Check if a match is found and extract the value
if (match && match[1]) {
    var eventSourceValue = match[1]; // The value of the key "dt.event.source"
    gs.info('Event Source: ' + eventSourceValue); // This will log to the system logs
} else {
    gs.info('No match found for dt.event.source');
}

Output:

*** Script: Event Source: AI9146.test.ca

If the above information helps you, kindly mark it as Helpful and Accept the solution.
Regards,
Najmuddin.

[Community Alums]

Hi Mohd,

I found a regex that works, but for some reason its not working in Event Rule. I need this to grab a specific value in Event Rule.

Regex used:

(.*)"key":"dt.event.source","value":"([^.]+)(\..*)?"}

Event Rule:

Not grabbing/returning any values

Tried mapping values to Metric field to see the returned values

Alert Metric is <<UNKNOWN>>