Event Rules - Regex and Groups

[stevemacamway]

I'm setting up an integration with Dynatrace SaaS, and I'm having trouble extracting one piece of data from the additional_info field. 

We are receiving the Dynatrace 'tags' as part of the additional_info. There are multiple entries in this 'tag' field, and I need to extract one of them. The order of the tags in this field could be different every time. 

The data is coming through like this:

"dt_Tags":"CI_ID:9f401c34db915fc4571a3a92ba961908, Role:Application Server, Country:Corp, Application:MAGIC Bonus, AppEnvironment:Theta, Region:Global"

So, of course the value of dt_Tags is:

CI_ID:CI_ID:xxx000555x76ad98325lkafd8, Role:Application Server, Country:Corp, Application:App Name, AppEnvironment:Theta, Region:Global

But, the tags could be in any order, so I could have:

Role:Application Server, Country:Corp, CI_ID:xxx000555x76ad98325lkafd8, Application:App Name, AppEnvironment:Theta, Region:Global

Or

Role:Application Server, Country:Corp, Application:App Name, AppEnvironment:Theta, Region:Global, CI_ID:xxx000555x76ad98325lkafd8

Using Regex101.com, I can extract the CI_ID using the following:

(?<=CI_ID:)(.*?)(?=$|\z|,) 

https://regex101.com/r/m6NWaC/3 

Note that the match information only lists 1 Group. 

If I take that regex and put it in my Event Rule, it wants to generate 3 fields:

Note the 2 entries on the right for 'Select or Add Field'.

Is there any way to get that to be seen as a single group? 

[RichG]

Thanks for this Steve. This really helped get me on the right path! All working now.

[moshe_d]

Hi

You can see here in the docs that regex101 isn't the perfect match for this.

https://docs.servicenow.com/bundle/london-it-operations-management/page/product/event-management/task/t_EMComposeOuput.html

you can combine your testing with regex101 and https://www.freeformatter.com/java-regex-tester.html

both of them will bring you great infromation on how to use

Regards, Moshe 

[RichG]

Thanks, using a combination of both sites really helped understand where I was going wrong

[Mike225]

That is PHP regex, and wont even save in the Edit Regex Expression Popup. You need to use JavaScript regex.