How to modify existing message key rule to include description also in message key of Alert

[Nitin Agarwal]

I want to include description in message key of event so that event should get correlated based on description field as well.

[robertgeen · Accepted solution]

So this is fairly easy to do just create an event rule and in the message_key transform section put some combination of description. I would recommend something like ${source}_${node}_${description} or some combination like that. Hope this helps.

[dbehnood]

I think you will hit the maximum character count for the Message Key field if you do so as if I recall it has a 1024 max length. Perhaps inject a static word/descriptor using a transform rule as Robert proposed?

${source}_${node}_${type}_"YourWordHere"