How to use content from additional information field of an alert in alert management rule >> launch applications?

[Andreas Kunath]

Hi,

inside the additional_info field in an alert we have information like this coming with the event:

{
"source_link" : "http://link.to-the-source-monitoring-system.com?id=12345"
}

Now we want to use this link in an alert management rule "Open Source Link" in Launch Applications section. But how we can address the URL? I tried like this:

URL=${additional_info.source_link} but it is not working.

Is there any way to reference on the fields from the JSON object inside additional_info? Or can we use any kind of regex in the ${...}?

Best regards
Andreas

[Andreas Kunath · Accepted solution]

Together with HI support we found the right answer:

We can address directly the field name from the JSON object from additional_info field by ${source_link}. The rule checks first for field names in the em_alert table and if not found checks the additional_info JSON object for the same field name.

[nick_hoppernb]

Andreas,

I'm running into a similar issue.  Could you provide some screenshots as I'm not getting the results.

Thanks in advance!

[Andreas Kunath]

Hi Nick,

The Launch Applications section in Alert Management Rule - Actions should look like this:

And in the field additional_info in the alert you should have something like:

{
  "source_link":"https://my.source.link"
}