Skip to main content

Match and Update action

Available for event and incident workflows

This action updates a field based on the contents of other fields. You specify a set of input fields to evaluate. Each input has a corresponding regex tag and an output value. On the first match, the action copies the output value to the output field.

This action provides a simple way to normalize events or incidents that have inconsistent formats. Suppose you have multiple event sources that indicate the event class - application, network, database, etc. - using different strings in different fields. You can use this action to find a matching string and then update the event class consistently based on the results.

This action takes the following inputs:

  • Input field(s)

    The set of input fields to search.

  • Regex Tags

    Each input field has a corresponding regex tag and output string. On the first match, copy the corresponding output string to the output field.

  • Output Field

    Apply the output string to this field.

Event example

You have two event sources. For one source, "ping" in the description field indicates a network event. For another source, "stored procedure" in the check field indicates a database event. You want to update the class field to either network or database.

Events Before:

{
   "description":"ping to cntnr04 > 200ms",
   "severity":4,
   "source":"cntnr04",
   "check":"rtt",
   "service":[ "infraTestService"]
} 

{
   "description":"proc get-all-addresses failed -- access denied",
   "severity": 5,
   "source": "pd4058",
   "check": "stored procedure get-all-addresses",
   "service":[ "custService"]
}

You set up your action as follows:

  • Input field(s): description, check

  • Regex Tags:

    • Contains => .*\bping\b.* => network

    • Contains => .*\bstored procedure\b.* => database

  • Output Field: class

Events After:

{
   "description":"ping to cntnr04 > 200ms",
   "severity":4,
   "source":"cntnr04",
   "check":"rtt",
   "service":[ "infraTestService"],
   "class" : "network"
} 

{
   "description":"proc get-all-addresses failed -- access denied",
   "severity": 5,
   "source": "pd4058",
   "check": "stored procedure get-all-addresses",
   "service":[ "custService"],
   "class" : "database"
}

Incident example

Suppose that you want any incident with the term "router" in its description to also have a tags.device value of "Router". You can accomplish this by creating an incident workflow with a Match and Update action.

After setting up the trigger, you can configure the Match and Update action as follows:

  • Input field(s): description

  • Regex Tags:

    • Contains => .*\b[Rr]outer\b.* => Router

  • Output Field: tags.device

Here is an example incident that was processed by this workflow:

Incident fields before

Incident fields after

{
    "status": "open",
    "severity": "major",
    "description": "ping failed, router ID=10039",
    "classes": [
      "Database"
    ],
    "services": [
      "support",
      "retail"
    ],
    "tags": {
    }
    ...
}

{
    "status": "open",
    "severity": "major",
    "description": "ping failed, router ID=10039",
    "classes": [
      "Database"
    ],
    "services": [
      "support",
      "retail"
    ],
    "tags": {
      "device": [
        "Router"
      ]
    }
    ...
}
 
In this section: