Skip to main content

Basic Variable Substitution Examples

This topic covers a few basic scenarios for using variable substitution for Moogsoft Onprem Workflow Engine function parameters.

For an overview of variable substitution with the Workflow Engine, see Variable Substitution in Workflow Engine Actions.

Substitute the value of an object field

This example shows the basic syntax to substitute the value of an object field for a parameter value. Imagine that you have a workflow to enrich an alert with information on the type of relevant hardware device. For example:

{...
"custom_info": {"enrichment":{
            "deviceType": "LS1010"}
                }}
...}

You want use a single Workflow Engine action that sets the value for the alert class based upon the custom_info.enrichment.deviceType. This is more efficient and simpler than creating separate actions to set the class for every unique device type.

In this case, create an action that uses the setClass function with the following argument:

  • class: $(custom_info.enrichment.deviceType)

Given the example alert, the Workflow Engine updates the class field as follows:

{
    "alert_id": 67,
    "class": "LS1010",
    "description": "switch down",
   ...
    "custom_info": {
        "enrichment": {
            "deviceType": "LS1010"
        }
    },
    ...
}

Use a substitution variable as part of compounded text

This example uses the alert from the previous example to demonstrate how to use a substitution variable as part of a larger string. Imagine that you want to include the value for the class field as part of the description for the alert.

In this case, create an action that uses the appendString function with the following arguments:

  • string: ; device type: $(class)

  • destination: description

Given an alert with class = "LS1010" and description = "switch down", the Workflow Engine updates the alert description as follows:

{
    "alert_id": 67,
    "class": "LS1010",
    "description": "switch down; device type : LS1010",
    ...
}

Use macros with variable substitution

Workflow Engine actions use the same substitution macro syntax as the Payload Mapping rules. See Configure Payload Mapping Rules for more information. You can use macros in the same way with Situation, alert, or event fields. Some macros have no effect because the datatype is a string. For example TO_STRING() and TO_INT() do not modify the substituted value .

For macro syntax, see Macros Reference

For example imagine you want to add the human-readable severity of the alert to the beginning of the description. You can accomplish this using substitution and the $EXPAND() macro. The macro eliminates the need to create a workflow for each possible severity.

In this case create an action that uses the prependString function with the following arguments:

  • string: $EXPAND(severity):

  • destination: description

Given an alert with severity = 5 and description = "switch down", the Workflow Engine updates the alert description as follows:

{
    ."alert_id": 68,
    "description": "Critical : switch down",
    "severity": 5, 
    ...
}