Basic Variable Substitution Examples

This example shows the basic syntax to substitute the value of an object field for a parameter value. Imagine that you have a workflow to enrich an alert with information on the type of relevant hardware device. For example:

{...
"custom_info": {"enrichment":{
            "deviceType": "LS1010"}
                }}
...}

You want use a single Workflow Engine action that sets the value for the alert class based upon the custom_info.enrichment.deviceType. This is more efficient and simpler than creating separate actions to set the class for every unique device type.

In this case, create an action that uses the setClass function with the following argument:

Given the example alert, the Workflow Engine updates the class field as follows:

{
    "alert_id": 67,
    "class": "LS1010",
    "description": "switch down",
   ...
    "custom_info": {
        "enrichment": {
            "deviceType": "LS1010"
        }
    },
    ...
}

This example uses the alert from the previous example to demonstrate how to use a substitution variable as part of a larger string. Imagine that you want to include the value for the class field as part of the description for the alert.

In this case, create an action that uses the appendString function with the following arguments:

Given an alert with class = "LS1010" and description = "switch down", the Workflow Engine updates the alert description as follows:

{
    "alert_id": 67,
    "class": "LS1010",
    "description": "switch down; device type : LS1010",
    ...
}

Workflow Engine actions use the same substitution macro syntax as the Payload Mapping rules. See Configure Payload Mapping Rules for more information. You can use macros in the same way with Situation, alert, or event fields. Some macros have no effect because the datatype is a string. For example TO_STRING() and TO_INT() do not modify the substituted value .

For macro syntax, see Macros Reference

For example imagine you want to add the human-readable severity of the alert to the beginning of the description. You can accomplish this using substitution and the $EXPAND() macro. The macro eliminates the need to create a workflow for each possible severity.

In this case create an action that uses the prependString function with the following arguments:

Given an alert with severity = 5 and description = "switch down", the Workflow Engine updates the alert description as follows:

{
    ."alert_id": 68,
    "description": "Critical : switch down",
    "severity": 5, 
    ...
}