Remove certain tag automatically

Question

Hello,

I'm having trouble to manage tags for the alert. Let's say the Googlestackdriver integration creates an alert with the following tags:

* "location:us-east1-a" (with "location:{{_payload.incident.resource.labels.zone}}")
* "location:" (with "location:{{_payload.incident.resource.labels.region}}" while _payload.incident.resource.labels.region doesn't exist)
* some other tags that is not started with "location:"

Alert filter doesn't appear to capable accepting any field within _payload, so I can't split create action into two.

Using the tag "location:{{_payload.incident.resource.labels.region}}{{_payload.incident.resource.labels.zone}}" is not feasible as I'm not able to guarantee both fields will not appear at the same time, unless I can use some sort of conditional expression within the dynamic field.

The worst case scenario is that I have to create an webhook integration and an API integration, so I can review and modify the alert automatically with external program.

As this method will increase the complexity of how a new alert is handled, I want to avoid that if possible.

Is Opsgenie able to remove tag with matching criteria from alert automatically with alert policy or something else natively on Opsgenie?

John M_2hpypf · Answer

Since your regex uses '+' it should only match tags that have at least one character after the semicolon - so 'location:' should not show up. When I tested this only the tag with a value after the semicolon was added to the description:

As for the case, I don't believe there is any workaround for that; I believe the system just translates all processed characters to lower case

Jacky Chen_jsee2x · Answer

OK, I've made some progress.

What I'm trying to achieve is to remove any tags with colon symbol at the end and, if possible, preserve capitals for the tags.

I use {{tags}} in the alert description and it gives me something like:

[location:us-east1-a, location:, instance_name:my-vm-instance, project_id:my-gcp-project, system:test]

I can sort of treat {{tags}} like a string in alert policy. I didn't find method to do string replace, with or without regex. This is what I came up with in the tags in the alert policy:

* location:{{tags.extract(/location:([^,\]]+)/)}}
* instance_name:{{tags.extract(/instance_name:([^,\]]+)/)}}
* project_id:{{tags.extract(/project_id:([^,\]]+)/)}}
* system:{{tags.extract(/system:([^,\]]+)/)}}

Although not elegant, it kind of works with one strange caveat: all characters has been converted to lowercase. There was a tag "system:Test" and it's now "system:test".

Is there anything I can achieve so I can remove tags ends with a colon symbol and preserve character case?

John M_2hpypf · Answer

Hi @Jacky Chen ,

Without knowing your exact requirements, you might be able to extract only the tags you need and 'remove' unwanted tags using either string processing, regex, or a combination of both:

https://support.atlassian.com/opsgenie/docs/string-processing-methods-in-opsgenie-integrations/

https://support.atlassian.com/opsgenie/docs/regular-expressions-for-improved-alert-filtering/