REST API JSON em_event table additional_Info field

[jkamshark]

Greetings Developer Community,

I am successfully inserting events within the em_event table utilizing the REST API. I am using PERL as the language. I create the structure below, JSON encode, and perform the REST client call which is successful.

my $event =

{

source                   => 'Spectrum',

node                       => 'somenode.somedomain',

severity               => '3',

resource               => 'somenode.somedomain',

description         => 'some description',

message_key         => '123456',

additional_info => {

                              ca_test_value => 'testvalue',

              },

};

$my request_body = encode_json ($event);

Encoded JSON

{"resource":"somenode.somedomain","source":"Spectrum","additional_info":{"ca_test_value":"test value"},"message_key":"123456","description":"some description","severity":"3","node":"somenode.somedomain"}

In the response body the additional_info key,value pairing appears to be an assignment statement opposed to a JSON structure.

Response snippet "additional_info":"{ca_test_value=testvalue}"

Event Rules fail when applying additional_info filtering e.g. ca_test_value is testvalue. The Istanbul documentation states that if the additional_info field is not interpreted as a valid JSON structure it will normalize it within the "additional_content" structure. I can successfully perform additional_info filtering such as "additional_content" contains testvalue but require filtering of the individual elements within the additional_info structure. Any help would be greatly appreciated.

Update:

I have also attempt to build the JSON structure without encoding with the same results. e.g.

my $request_body ="{\"node\":\"somenode\",\"source\":\"Spectrum\",\"description\":\"Testing\",\"severity\":\"Minor\",\"additional_info\":{\"ca_spec_value\":\"testvalue\"}}";

[damodarreddyp]

can you try it as an array, instead of object as below:

additional_info => [

                              ca_test_value => 'testvalue',

              ]

[jkamshark]

Made the suggested change and additional_info is as follows in the JSON response.

[ca_test_value, testvalue]

[josh_nerius · Accepted solution]

Hi John,

The issue here is that the event engine is expecting additional_info to be a JSON string, but it's being sent as an object instead.

Try this instead:

my $additional_info = {
               ca_test_value => 'testvalue',
};

my $event = {
               source                   => 'Spectrum',
               node                       => 'somenode.somedomain',
               severity               => '3',
               resource               => 'somenode.somedomain',
               description         => 'some description',
               message_key         => '123456',
               additional_info => encode_json($additional_info)
};

my $request_body = encode_json($event); 

This will ensure the additional_info value is sent as a JSON string.

[jkamshark]

Thanks to all that replied and thanks Josh for the insight and solution. It works!