Hi,
To create and use a regex in an Event Rule in ServiceNow, follow these steps:
Creating Regex in Event Rule:
-
In the "Event Input" Pane:
- Select the field where the regex will be applied.
- To create a regex expression, you can switch to regex mode (instead of the default standard mode).
-
In Regex Mode:
- When you select regex edit mode, the highlighted text is replaced with
(.*) to create the regex pattern.
- Regex works by matching patterns in the incoming event fields. It uses an exact match for input from the event fields, so ensure that the expression you are building matches the full input text correctly.
For example, if you want to extract part of a value like vhxy2stlgwc_8888_hec03v012979, a basic regex expression would be ^([^_]+)_.* to match everything before the underscore, i.e., vhxy2stlgwc.
-
In the "Expressions" Section:
- After creating the regex, the expression name and its value will appear in the Expressions pane.
- In the Expression section, you can select or add a field name from the list or enter a custom expression name.
- The variables you use in your regex must appear in the same order they appear in the event field, so keep that in mind when constructing the regex.
-
Transform vs Compose:
- Transform: In this mode, you create a field to display in the alert. The field and its value will appear in the Additional Information or Alert Tags section of the generated alert.
- Compose: This allows you to customize the text in the selected field. You can drag fields from the Event Info pane into the field or use the format
${<fieldname>} to reference a field. You can also freely enter text, spaces, or characters to make the alert content more readable.
How Regex Works:
- Regex in the Event Rule is used to capture and parse specific data from the incoming event. For example, you may use regex to extract the Node value from the event data if it's in a known pattern (e.g.,
node_1234_abc).
- The regex engine tries to match the entire string to the defined pattern. If it matches, the extracted value can be used in the Event Rule for further processing or alert formatting.
Example:
- If you're trying to capture a Node field, you can write a regex to match a pattern like
node_<number>_type where <number> represents the node ID, and <type> can be a string representing the node type.
- In this case, the regex would look something like
^node_(\d+)_([a-zA-Z]+)$, where (\d+) captures the number and ([a-zA-Z]+) captures the type.
After applying your regex, the matched values can be displayed in the Alert Tags or Additional Information sections depending on how you configure the rule.
Next Steps:
- Once the regex is created, and the expression is applied, you can Save or Update the event rule.
- If you need further customization, you can configure which fields are displayed in the alert using the Manual Attributes checkboxes.
The above has been summarized from the below document:
https://www.servicenow.com/docs/bundle/yokohama-it-operations-management/page/product/event-manageme...
https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0690762
If you believe the solution provided has adequately addressed your query, could you please **mark it as 'Helpful'** and **'Accept it as a Solution'**? This will help other community members who might have the same question find the answer more easily.
Thank you for your consideration.
Selva
