Alert Query / JQL regex

Question

I am struggling with the JQL / Alert Query results - it seems that wildcard searches are only working from the start of the field.  I cannot seem to get a match, for instance, for all open alerts whose message ends with "broken.sh"

Is there a regex/pattern-match facility available?  We really want OpsGenie to work for us, but at the moment, being able to purge / group-add multiple messages to an Event seems incredibly hard.

We want to be able to use an automatic match of alerts to known events, so being able to have a match / move / (increment/update event) - so that we can encourage monitoring without being encumbered by thousands of alerts.

Maybe I am missing something.

Ben Griffin · Answer

Yes, I am using some extraction for integration passing - but what is really weird is that there doesn't seem to be much in the way of a definition of acceptable values, or even a full list of available fields.

IMO, the Opsgenie seems to be 'beta', regardless of it's 'pro' pricing model.

Nick Haller · Answer

Hi @Ben Griffin ,

The Alerts tab does lack some functionality when it comes to searching for pieces of a string - especially if the piece is not at the start when using a wildcard like you mentioned.

We currently have a few feature requests open for this functionality you can follow, watch and vote for here:

As a customer I would like to search and filter alerts using regex

Ability to use wildcard (*) in the front and back of strings

Alternatively to the Alerts tab, the Alert Analytics report can pull alerts when they contain a certain string.

Moving forward, you could also use regex or string processing to extract the string into an alert field, and filter on that too - maybe something like extracting the string as a tag. This Community Article might help on methods to do this.