Event Rules - Regex and Groups

[stevemacamway]

I'm setting up an integration with Dynatrace SaaS, and I'm having trouble extracting one piece of data from the additional_info field. 

We are receiving the Dynatrace 'tags' as part of the additional_info. There are multiple entries in this 'tag' field, and I need to extract one of them. The order of the tags in this field could be different every time. 

The data is coming through like this:

"dt_Tags":"CI_ID:9f401c34db915fc4571a3a92ba961908, Role:Application Server, Country:Corp, Application:MAGIC Bonus, AppEnvironment:Theta, Region:Global"

So, of course the value of dt_Tags is:

CI_ID:CI_ID:xxx000555x76ad98325lkafd8, Role:Application Server, Country:Corp, Application:App Name, AppEnvironment:Theta, Region:Global

But, the tags could be in any order, so I could have:

Role:Application Server, Country:Corp, CI_ID:xxx000555x76ad98325lkafd8, Application:App Name, AppEnvironment:Theta, Region:Global

Or

Role:Application Server, Country:Corp, Application:App Name, AppEnvironment:Theta, Region:Global, CI_ID:xxx000555x76ad98325lkafd8

Using Regex101.com, I can extract the CI_ID using the following:

(?<=CI_ID:)(.*?)(?=$|\z|,) 

https://regex101.com/r/m6NWaC/3 

Note that the match information only lists 1 Group. 

If I take that regex and put it in my Event Rule, it wants to generate 3 fields:

Note the 2 entries on the right for 'Select or Add Field'.

Is there any way to get that to be seen as a single group? 

[moshe_d · Accepted solution]

If you need only the "CI_ID" field you can extract that like that: 

CI_ID:\K[^,]*

see example: regex101

[stevemacamway]

Thanks moshe_d - that worked. Now if the Event Rule would actually use that to parse the data out. 

It shows correctly in the Designer, but when I send an Event through, it comes back with '<<UNKNOWN>>' instead of a value. 

I guess it is time for a new question!

Thanks for your help. 

[RichG]

Hi Steve

I'm facing the same challenge as you.

I'm using regex which works on regx101, but I'm receiving UNKNOWN in the alert afterwards, which is what I think you described above. In the Alert it's just currently mapped into the Additional information field at the moment.

I'm using the London release.

I looked to see if there was another thread on this, but couldn't see any.

Any help would be very welcome.

Many thanks

Rich

[SteveMac1]

RichG - I don't remember why I ended up with this, but here is what finally worked:

.*CI_ID:([^,]*).*

It works great on the following, but if I remember correctly, it should capture the field data I'm interested in regardless of where it is in the string:

"dt_Tags" : "CI_ID:c85e9803db1d3623a78ad2c75e961981, Subregion:CORP, Environment:PROD, InfraProvider:ADC, Application:SAP, Region:Global"

Here's the complete addl_info:

{
 "ImpactedEntity" : "Failure rate increase on 2 Services}",
 "PID" : "not_happening",
 "ProblemID" : "578",
 "ProblemSeverity" : "ERROR",
 "ProblemTitle" : "Failure rate increase",
 "ProblemURL" : "https://nope.live.dynatrace.com/#problems/problemdetails;pid=not_happening",
 "dt_CIID" : "c95e9803db1d3600a78ad2c75e961981",
 "dt_Tags" : "CI_ID:c85e9803db1d3623a78ad2c75e961981, Subregion:CORP, Environment:PROD, InfraProvider:ADC, Application:SAP, Region:Global",
 "dt_severity" : "RESOLVED"
}