Help with Regex in Azure Monitor Payload

[Dhana1]

I need help with the regex to pick the 4 values from the Custom Message which is coming from the properties in the additional information for Azure Monitor Payload.

Need to pick the ImpactedVM, Failure Code, Resource group, Recovery Vault values  from the below Custom Message.

{CustomMessage={"ImpactedVM":"hosazr12dc02","FailureCode":"UserErrorGuestAgentStatusUnavailable","ResourceGroup":"rg-nga-p-eus2-sharedservices-compute-01","RecoveryVault":"rsv-p-eus2-sis-backup-01"}}

I have created an event rule and when tried with the regex populating the values in the event rule but when alert is processed the unknown vales are being populated.

[Viraj Hudlikar]

Hello @Dhana1 

Your regex will be as below:

/"ImpactedVM":"(?<ImpactedVM>.*?)","FailureCode":"(?<FailureCode>.*?)","ResourceGroup":"(?<ResourceGroup>.*?)","RecoveryVault":"(?<RecoveryVault>.*?)"/gm

ImpactedVM =  $(ImpactedVM)

FailureCode = $(FailureCode)

ResourceGroup = $(ResourceGroup)

RecoveryVault = $(RecoveryVault)

Note - You can validate regex on this site = https://regex101.com/

If my response has helped you, hit the helpful button, and if your concern is solved, do mark my response as correct.

Thanks & Regards
Viraj Hudlikar.

[Dhana1]

Hi Viraj,

Thank you for your reply.

Regex is working on regex101 site and in the event rule also populating the values but in the Alert description its showing unknown values .