Alert rule enrichment regex guide

Ngauthier
Giga Expert

Hello, 

 

Editing as I have gained more information since initially posting
Please note that I cannot use any scripting, and everything needs to be done within the www.instance.service-now.com/now/sow/enrich-automation/x page.

 

I am trying to figure out how to extract specific data from a serialized json string within the additional info field. The only thing I've been able to do so far is use (.....)*. to extract speficied text by positioning, but this is extremely unreliable. My string looks a bit like this

{"json_rootfield1":"{\"custom_field1\":\"Value_1 \\n\",\"custom_field2\":\"Value_2 \\n\",\"custom_field3\":\"Value3\",\"custom_field4\":\"Value4 \\n\",\"custom_field5\":\"Value5\",\"custom_field6\":\"Value6\",\"custom_field7\":\"Value7\",\"custom_field8\":\"Value8\"}","json_rootfield2":true,"json_rootfield3":"1234"}

How would I, for example, extract the rootvalue2 from this string? Is there any documentation anywhere that is more in depth than the SNow page because that one is extremely barebones. The goal is to do this without the use of scripting.

I have successfully extracted using regex101. However, ServiceNow uses it's own regex backend with slight differences. even using \d{4} fails to extract a 4 digit number from a string such as this:

<99>TEXT: 'TEXT_9999' INFO: INFORMATION

I've also uploaded two sample regex which should theoretically work, but do not.

Ngauthier_0-1768704744578.pngNgauthier_1-1768704748706.png

 



1 ACCEPTED SOLUTION

Ngauthier
Giga Expert

I've found the nomenclature for this to function properly, at least for the following example. Given the text below
<99>TEXT: 'TEXT_9999' INFO: INFORMATION

a regex of .*([0-9]{4}).* will output the proper information.
This seems to be due to two reasons. The search does not look through the entire input by default, hence the need for .* encapsulating the query, which returns a match for the entire input. We then require the regex to be within parenthesis to create the group, outputting the desired data.  Here is a screen capture explaining the results

Ngauthier_0-1768711370683.png

 

 

I will mark this as resolved for future reference. Thank you everyone

View solution in original post

6 REPLIES 6

mugi-san
Kilo Sage

Hi @Ngauthier 

 

If the JSON file works across other programs, basic JavaScript can be used as described in the document below.

 

{

  "json_rootfield1": {

    "custom_field1": "Value_1 \n",

    "custom_field2": "Value_2 \n",

    "custom_field3": "Value3",

    "custom_field4": "Value4 \n",

    "custom_field5": "Value5",

    "custom_field6": "Value6",

    "custom_field7": "Value7",

    "custom_field8": "Value8"

  },

  "json_rootfield2": "rootvalue2",

  "json_rootfield3": "rootvalue3"

}

 

https://www.servicenow.com/docs/ja-JP/bundle/zurich-api-reference/page/app-store/dev_portal/API_refe... 

 

Regards.

Hi @mugi-san 

Unfortunately, the goal is to avoid scripting altogether and use solely the Alert Enrichment page. Since posting, I've looked at the following page

https://www.servicenow.com/community/developer-articles/common-regular-expressions-and-cheat-sheet/t...

I've successfully used the info on here to extract from my text using 3rd party websites such as regex101, but as I understand it, ServiceNow uses a different regex backend. 

Even this simple sample does not find a match

Sample value:
<99>TEXT: 'TEXT_9999' INFO: INFORMATION

Regex:
\d{4}

 

 

This leads me to believe that the Alert Enrichment via Regex is not functionning properly, or the backend is unique and I would require the help of a ServiceNow support agent for additional help.

Any link to additional documentation would be greatly appreciated

P.S.
Note that the above example is not a json, but a simple string. I attempted extraction via regex using a simpler format to diagnose

 

Hello @Ngauthier .

 

If you would like to change the topic from your initial inquiry, creating a new question will help minimize confusion.

According to the official documentation for the feature you provided, it states that compatibility with PCRE (Perl Compatible Regular Expressions) is guaranteed.

 

https://www.servicenow.com/docs/csh?topicname=enrich-alert-sow-itom.html&version=latest

 

However, a technical characteristic of the PCRE engine is that its behavior in regular expressions can vary depending on how ServiceNow compiled it into their environment. Furthermore, there is no verified information regarding the extent of ServiceNow's regex support, such as any limitations implemented for vulnerability mitigation.

As you mentioned, if basic regular expressions are not functioning, it will be necessary to open a support case with ServiceNow and wait for a fix.

 

Regards.

Tejas Adhalrao
Tera Guru

Hi @Ngauthier ,

it seems double encoded json ,you can use JSON.parse twice :

 

var obj = JSON.parse(additional_info);
var inner = JSON.parse(obj.json_rootfield1);
gs.info(obj.json_rootfield2); 

 

 

 If you found my solution helpful, please mark it as Helpful or Accepted Solution...!

thanks,

tejas

Email: adhalraotejas1018@gmail.com

LinkedIn: https://www.linkedin.com/in/tejas1018