How to modify existing message key rule to include description also in message key of Alert

Nitin Agarwal
Kilo Contributor

I want to include description in message key of event so that event should get correlated based on description field as well.

 

1 ACCEPTED SOLUTION

robertgeen
Tera Guru

So this is fairly easy to do just create an event rule and in the message_key transform section put some combination of description. I would recommend something like ${source}_${node}_${description} or some combination like that. Hope this helps.

View solution in original post

2 REPLIES 2

robertgeen
Tera Guru

So this is fairly easy to do just create an event rule and in the message_key transform section put some combination of description. I would recommend something like ${source}_${node}_${description} or some combination like that. Hope this helps.

dbehnood
Tera Expert

I think you will hit the maximum character count for the Message Key field if you do so as if I recall it has a 1024 max length. Perhaps inject a static word/descriptor using a transform rule as Robert proposed?

 

${source}_${node}_${type}_"YourWordHere"