I suspect you are not referring to description but instead the Message Key field concatenation: Event identifiers
As for the alert.description field it's whatever value is passed into the event from your source or mapped there in your event/mapping rule. I wrote this out in case it helps anyone going forward...
- Alert description field mapping
- The ootb field mapping for description is alert.description = event.${description} unless you populate another variable or value.
- Passing an event with no description value will result in no alert description value.
- Alert.message_key = event.message_key or if not populated it will concatenate Source_Node_Type_Resource_Metric Name field values.
- The ootb field mapping for description is alert.description = event.${description} unless you populate another variable or value.
- Incident description field mapping from alert
- Incident/tasks created from an alert will inherit the alert.description unless you hard coded one in the Task Template.
- The EvtMgmtIncidentHandler script is where this mapping is populated as shown in this snippet:
/*
* fills and creates the task
*/
EvtMgmtIncidentHandler.submiteTask = function(alert, task, rule, isRemoteIncident, ruleType, autoOpen) {
task.initialize();
// alert shows Description, while Incident shows Short Description
// Therefore we are going to copy Description of Alert into
// Short Description of Incident
// alert Severity is 0-5 (Clear, Critical, … Info)
// while Incident severity is 1-3 (High, Medium, Low)
// Therefore we are going to map 1 to 1, 2 to 2
// and the rest Alert Severities (3,4,5,0) to 3 (Low)
task.setValue('short_description', alert.description);
task.setValue('description', alert.description);
task.setValue('cmdb_ci', alert.cmdb_ci);
- Custom Incident field mapping beyond Task Templates
- You can script in the EvtMgmtCustomIncidentPopulator script include : Populate alert fields from a task template and custom script
- Here I scripted a concatenation like your initial question which might be helpful for when a source passes no description to an event.
- *This could/should be done in the event/mapping rules however here we can do it once to apply to all event sources.
var EvtMgmtCustomIncidentPopulator = Class.create();
EvtMgmtCustomIncidentPopulator.prototype = {
initialize: function() {
},
type: 'EvtMgmtCustomIncidentPopulator'
};
EvtMgmtCustomIncidentPopulator.populateFieldsFromAlert = function(alert, task, rule){
// Usage example:
task.description += 'Empty description from source: ' + alert.source + ', Resource: ' + alert.resource + ',Metric Name: ' + alert.metric_name + ',Node: ' + alert.node;
- task.short_description += 'Empty description from source: ' + alert.source + ', Resource: ' + alert.resource + ',Metric Name: ' + alert.metric_name + ',Node: ' + alert.node;
return true;
};
I really am asking about the short_description field.
Maybe it's a customization I have not been made aware of (I'm fairly new to the company), but I cannot find where it is happening.
An event comes in with the following...
but what I see in the alert is...
