How to add "Event Raw Info" in Event Rule

[Takumi Ando]

In the "Transform and Compose Alert Output" section of the event rules,

I would like to use the value of the "Time of event" [time_of_event] field.

I would like to know if anyone knows how to do this.

[BookerE1]

---

@Takumi AndoDog Needs Best wrote:

In the "Transform and Compose Alert Output" section of the event rules,

I would like to use the value of the "Time of event" [time_of_event] field.

I would like to know if anyone knows how to do this.

---

Hello,

The “Transform and Compose Alert Output” section of the event rules allows you to modify and enrich the alert data that is generated from an event. You can use the Event Input and Alert Output fields to map the event fields to the alert fields, or use the Script field to write custom logic for the alert transformation.

If you want to use the value of the “Time of event” [time_of_event] field in the alert output, you have a few options:

• You can use the Event Input field to select the “Time of event” [time_of_event] field from the event, and then use the Alert Output field to select the alert field where you want to store the value. For example, you can map the “Time of event” [time_of_event] field to the “Created” field of the alert, so that the alert creation time matches the event time.
• You can use the Script field to write a script that accesses the “Time of event” [time_of_event] field from the event and assigns it to the alert field of your choice. For example, you can write something like this:

// Get the time of event from the event
var timeOfEvent = event.time_of_event;

// Set the time of event as the created time of the alert
alert.created = timeOfEvent;

• You can use the Additional Information field to store the “Time of event” [time_of_event] field as a JSON object, and then use the Event Input field to select the Additional Information field from the event, and the Alert Output field to select the Additional Information field of the alert. This way, you can preserve the “Time of event” [time_of_event] field as part of the alert data. For example, you can add something like this to the Additional Information field of the event:

{
"time_of_event": "2024-02-20 12:04:45"
}

I hope this helps you use the value of the “Time of event” [time_of_event] field in the alert output.

Please let me know if you have any other questions or feedback.

I’m always happy to help.

Best Regard
BookerE1

[Takumi Ando]

Thanks for your answer.

I am not sure where the "Script field" is located, can you give me a screen image?

What I want to do is to combine the "Message key" and "Time of event" values in the event record and set them to the "Message key" in the alert record.

[BookerE1]

---

@Takumi Ando wrote:

Thanks for your answer.

I am not sure where the "Script field" is located, can you give me a screen image?

What I want to do is to combine the "Message key" and "Time of event" values in the event record and set them to the "Message key" in the alert record.

---

Hello,

The “Script field” is located at the bottom of the “Transform and Compose Alert Output” section of the event rules. You can use it to write custom logic for the alert transformation using JavaScript. Here is a screen image of the “Script field” highlighted in red:

If you want to combine the “Message key” and “Time of event” values in the event record and set them to the “Message key” in the alert record, you can write something like this in the “Script field”:

// Get the message key and time of event from the event var messageKey = event.message_key; var timeOfEvent = event.time_of_event;

// Concatenate the message key and time of event with a separator var combinedKey = messageKey + " - " + timeOfEvent;

// Set the combined key as the message key of the alert alert.message_key = combinedKey;

I hope this helps. If you have any other questions, please let me know.

Best Regard,
BookerE1