Event management Event rule

[priceless]

Hi Team

Need your inputs/help on event rule writing for a multiple line text from description field. Actually from MS Az we are only receiving description in event table. How can we parse and get values to event's multiple attributes like node etc ..

Vendor says from multiple line text field (description) regex wont work in event rule to pick Node etc values but it will work if its single line. But we need other values also in description field.

Please suggest possible solution to overcome this issue.

Description looks like below:

Alert : Fired:Sev2 Azure Monitor Alert VM CPU Utilization Exceeded 75 on SERVERXX
version : 2.0
properties :
status : Activated
context : {
"timestamp": "2022-04-25T13:26:24.4145113Z",
"id": "/subscriptions/xxxxxxxxxxxx06-abcd/resourceGroups/abcdfgp01/providers/microsoft.insights/metricalerts/VM CPU Utilization Exceeded 75",
"name": "VM CPU Utilization Exceeded 75",
"description": "VM CPU Utilization Exceeded 75",
"conditionType": "MultipleResourceMultipleMetricCriteria",
"severity": "2",
"condition": {
"windowSize": "P",
"allOf": [
{
"metricName": "Percentage CPU",
"metricNamespace": "Microsoft.Compute/virtualMachines",
"operator": "GreaterThan",
"threshold": "75",

Regards

Rash

[priceless]

Forgot to mention that this issue was resolved by doing Webhook integration with Azure and then Push connector script and Event rules. After that we were able to receive Azure resource group configuration details etc in Event table properly. But we need to also coordinate with Azure team so that can understand to configure resource group and send events to ServiceNow. Our case resolved end-2-end.