Skip to main content

Parse FQDN action

Available for event and alert workflows

This action parses an FQDN field and copies the host and domain names to the specified fields.

  • FQDN Field

    The field that contains the fully-qualified domain name.

  • Short Output Field

    The action copies the hostname to this field.

  • Domain Output Field

    The action copies the domain name to this field (optional)

Event example

Your event sources populate the source field with the FQDN. You want your events to use the hostname for the source and store the domain name in a tag. You add a Parse FQDN action to your workflow and format it as follows:

  • FQDN field = source

  • Short output field = source

  • Domain output field = tags.domain

Event before

Event after

{
  "source": "myHost.myApp.myDomain.com",
  ....
} 

{
  "source": "myHost",
  ....
  "tags": {
    "domain": "myApp.myDomain.com",
  }
}

Alert example

Suppose all of the alerts from a specific monitoring source come from the same source URL, and you want to populate the manager field with the URL domain. (Separately, you plan to extract the underlying event sources from the description fields and replace the source fields for these alerts.) You can accomplish the manager mapping with Parse FQDN and Remove Tags workflow actions.

Use these settings for the Parse FQDN action:

  • FQDN field = source

  • Short output field = tags.drop

  • Domain output field = manager

Use these settings for the Remove Tags action:

  • Include = Exclude

  • Regex patterns = drop

Alert before

Alert after

{
  "source": "MyCompany.MyMonitoringSoftware.com",
  ...
} 

{
  "source": "MyCompany.MyMonitoringSoftware.com",
  "manager": "MyMonitoringSoftware.com",
  ...
}
In this section: