Regular Expression (Regex) to Filter Alerts

Introduction

Regex or Regular Expression is one of the most powerful, flexible, and efficient text processing approaches. Regex is a sequence of characters that specifies a search pattern in text.

OpsRamp supports regular expressions while creating or editing the alert escalation policy and first response policies. The Regex is used to match the data provided while defining alert and resource conditions. If the data matches, the policy will be applied, and the alert will be escalated for further processing.

The following are some of the examples for common use cases that explain how to use the regex with Property selected as Alert:Subject:

Condition: Contains

To filter the alerts for which the alert subject contains one of the ping, net, or monitor input values, the following regex can be used within the Contains condition:

.*ping.*|.*net.*|.*monitor.*

Condition: Not Contains

To filter the alerts for which the alert subject does not contain any of the ping, net, or monitor input values, the following regex can be used within the Not Contains condition:

.*ping.*|.*net.*|.*monitor.*

Condition: Not Equals

To filter the alerts for which the alert subject is not equal to the ping, net, or monitor input values, the following regex can be used within the Not Equals condition:

.*ping.*|.*net.*|.*monitor.*

Condition: Regex (Starts With)

To filter the alerts for which the alert subject starts with network input value, the following regex can be used within the Regex (Starts With) condition:

Note: In Regex (Starts With), there is no need to add the .* at the beginning of the input value.

network.*|windowsdevice.*|monitor.*

Condition: Regex (Ends With)

To filter the alerts for which the alert subject ends with monitor input value, the following regex can be used within the Regex (Ends With) condition:

Note: In Regex (Ends With), there is no need to add the .* at the end of the input value.

.*network|.*windowsdevice|.*monitor

Condition: Regex (Equals)

To filter the alerts for which the alert subject equals the input value provided in the field, the following regex can be used within the Regex (Equals) condition:

memory|cpu|network|vmware

Condition: Regex (Not Contains)

To filter the alerts for which the alert subject does not contain any of the Status, ping, SNMP TRAP input values, the following regex can be used within the Regex (Not Contains) condition:

^(?!.*(Status|ping|SNMP TRAP)).*$

Regex - ML Training file Support

For the alert ML file, use the below supported regex conditions to validate the expressions.

Condition: Equals

matches(?,".mem.")

Condition: Contains

contains(?,"load")

Condition: Not Contains

not(contains(?, "system"))