Event Rule Regex parse value from JSON values

Community Alums
Not applicable

Hello,

 

could someone help me figure out how to grab the value of the red text? I am having a hard time creating a regex for Event Rule.

 

I wanted to extract the value of the key <dt.event.source>= A19146.test.ca

 

{"key":"dt.event.group_label","value":"Availability"},{"key":"dt.event.impact_level","value":"Infrastructure"},{"key":"dt.event.is_rootcause_relevant","value":"true"},{"key":"dt.event.preferred_entity_type","value":"os:service"},{"key":"dt.event.source","value":"AI9146.test.ca"},{"key":"dt.event.timeout","value":"5"},{"key":"dt.event.title","value":"World Wide Web Publishing Service is in undesirable (running) state"},{"key":"dt.host_group.id","value":"safasdfasf"},{"key":"dt.osservice.display_name","value":"asdfasdfasdf"},{"key":"dt.osservice.name","value":"W3SVC"},{"key":"host.name","value":"AI9146.test.ca"}]}

2 REPLIES 2

Najmuddin Mohd
Mega Sage

Hi @Community Alums ,
Can you try the below one.

var data = '[{"key":"dt.event.group_label","value":"Availability"},{"key":"dt.event.impact_level","value":"Infrastructure"},{"key":"dt.event.is_rootcause_relevant","value":"true"},{"key":"dt.event.preferred_entity_type","value":"os:service"},{"key":"dt.event.source","value":"AI9146.test.ca"},{"key":"dt.event.timeout","value":"5"},{"key":"dt.event.title","value":"World Wide Web Publishing Service is in undesirable (running) state"},{"key":"dt.host_group.id","value":"safasdfasf"},{"key":"dt.osservice.display_name","value":"asdfasdfasdf"},{"key":"dt.osservice.name","value":"W3SVC"},{"key":"host.name","value":"AI9146.test.ca"}]';

// Regular expression to find the "key": "dt.event.source" and capture the value
var regex = /"key":"dt\.event\.source","value":"([^"]+)"/;

// Apply the regex
var match = data.match(regex);

// Check if a match is found and extract the value
if (match && match[1]) {
    var eventSourceValue = match[1]; // The value of the key "dt.event.source"
    gs.info('Event Source: ' + eventSourceValue); // This will log to the system logs
} else {
    gs.info('No match found for dt.event.source');
}

 

Output:

*** Script: Event Source: AI9146.test.ca


If the above information helps you, kindly mark it as Helpful and Accept the solution.
Regards,
Najmuddin.

Community Alums
Not applicable

Hi Mohd,

 

I found a regex that works, but for some reason its not working in Event Rule. I need this to grab a specific value in Event Rule.

 

Regex used:

(.*)"key":"dt.event.source","value":"([^.]+)(\..*)?"}

 

Event Rule:

 

jamiecagod1_0-1732558294242.png

 

Not grabbing/returning any values

jamiecagod1_1-1732558317085.png

 

Tried mapping values to Metric field to see the returned values

jamiecagod1_2-1732558332406.png

 

Alert Metric is <<UNKNOWN>>

 

jamiecagod1_4-1732558401094.png