message.extract, regex and line breaks (oh my!)

Question

Thanks to the support docs and other questions here, I've made great progress in using message.extract to populate tags and extra properties fields. But I have one situation where I'm failing to extract data, my property is always blank. I'm guessing it has to do with line breaks, since my other extracts were always from a single line. I've looked at the alert from the web UI, and also exported via API, and I have regex that will match either format, but it's still not matching.

My extract string:

{{ message.extract(/SEARCH STRING(?:\r\n +)*
*(\S+[^\
]+)/) }}(the string I'm extracting will vary a lot, so I can't just find word "vendor", but the string "SEARCH STRING" is constant, which is my I'm trying to use that as the 'anchor' for my regex)Description when viewed from web UI:

Description when pulled via API:

Test of regex string:

Thanks in advance for any tips!

Talar Pavlovic · Answer

Sure - you can see how the payload in the Opsgenie Logs. To do this:

* Open the Alert and go to the Activity Log tab
* Scroll to the very first entry at the bottom and copy the  "IncomingDataId". 
* Go to Settings > Logs 
* Search for "<incomingdataid>" making sure the timeframe is wide enough to capture this alert

If you do need more specific assistance here could I recommend putting in a support ticket so we can look at your payload and advise accordingly?

Regards,
Talar

Allen Wolf_tidjsv · Answer

Thanks!! This would go before the extract I assume? so {{ message.removeAllWhitespace().extract(/<regex>/) }}

EDIT: this might get me closer, but some of the strings I'm trying to capture will have spaces. Is there a way to see the Description / Message field, formatted in the same way as the regex engine 'sees' it?

EDIT: either way, my regex still isn't working

{{ message.removeAllWhitespace().extract(/SEARCHSTRING(.*)RULEREASON/) }}

Thanks!

Talar Pavlovic · Answer

Hey there Allen,

Thanks for writing into Opsgenie Community, I'm Talar from the Atlassian team, happy to help.

In this instance, it would be worth trying the .removeAllWhitespace() command to see if that will help return the string required.

Regards,
Talar