Regex Issue in Event Rule to adjust for 2 Use Cases

[Dhana1]

Hi,

We have Event rules working for New Relic which was working fine earlier but recently few Alerts populating unknown values due to issue in regex.

On these event rules, we have a regular expression retrieving data from the "nrTag.entityKey" value. Normally, the server name appears with the full domain name (server.mydomain.com) but, on some cases it arrives without the domain (server) now trying to adjust the regex to work for both cases (server.mydomain.com VS server).

Please find the data existed in "nrTag.entityKey" in both cases,

1) "nrTag.entityKey":"ora-instance:FT1:endpoint=frdr3tdc01.ford.erp:1527:servicename=ft1"  --> server.mydomain.com

2) "nrTag.entityKey" : "ora-instance:BD1:endpoint=bnsr3dci:1527:servicename=bd1"  ---->Server

I thought to create a new event rules to adapt the second case but not sure what to differentiate between both use cases in Event Filter so trying to fix the regex issue to work for both cases.

Currently we are using the regex in our Event Rule as 

.*:(.*?):endpoint=(.*?)\..*:(.*?):servicename=(.*)

Please help me with regex to fix the issue or any suggestions for the new event rule to differentiate them.

[Ashish Parab · Accepted solution]

@Dhana1 ,

Please try by using below regex -

.*:(.*?):endpoint=([^.]+)(\..*)?:(.*?):servicename=(.*)

This pattern accepts both of the inputs you provided. You can test it on https://regexr.com/

Please mark this as "correct" and "helpful" if you feel this answer helped you in anyway.

Thanks and Regards,

Ashish

[Dhana1]

Hi Ashish,

Thanks for your reply.

Regex is working fine in both cases 

.*:(.*?):endpoint=([^.]+)(\..*)?:(.*?):servicename=(.*)