Event Filter - value "matches regex" or "matches pattern"

[a_soto87]

Has anyone been able to find what works or doesn't work? I've been chasing it this morning and "matches pattern" works if you simply put something like *SW* but the second I try to make it more advanced with additional text it doesn't work.

For example, I have this working in many other examples, worth noting not within ServiceNow but for the purposes of regex logic, and that doesn't work in ServiceNow if I leverage "matches regex". So I've tried variations of the following:

(?)^.*(SW|Annex).*

.*(SW|Annex).*

*(SW|Annex)*

(*SW*|*Annex*)

It's also worth noting that some of this doesn't exactly make sense within regex, as in it likely doesn't/wouldn't work, but I'm trying many combinations between these two conditions to figure out what works.

In the end, if I need to filter based on the Node "contains" SW or Node "contains" FW, for switch/firewall naming conventions, leveraging regex would be ideal - certainly helps reduce the number of conditions on an event filter, simplifies it IMO, but all that I've found is that I can use 50x contains "whatever value" or 50x matches pattern "whatever value".

Any help is appreciated while I keep fiddling with this.

[AnveshKumar M]

Hi @a_soto87 ,

I had this issue a month back, after fiddling for 2 long days, I found that match regex and match pattern in filter condition is broken long back and the documentation is not updated about this.

https://www.servicenow.com/community/developer-forum/matches-regex-or-matches-pattern/m-p/1869150#M5... 

Thanks,

Anvesh

[a_soto87]

I was able to use ".*(value1|value2|value3).*

Note: case sensitive

[Denise Taylor2]

Check out this post.  As explained there,

The regex for event rules is a bit more sensitive than that and the entire string has to be captured or it would only parse correctly if the entire beginning of the string was exactly the same each time.  The Xplore regex tester unfortunately does not use the same backend regex as event management rules (nor does regex101 or most other popular testers).

So if your regex isn't working, try a .* at the beginning and/or end of your regex statement.

Also, it appears you can configure regex101 to test regex as per ServiceNow EM requirements.  Check out this KB article.