nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

searching alerts for number in subject

Petr Novotny_2d0815

Hi, I have following alert
[Prometheus]: CRITICAL on 10.100.129.192:9104 - Exporter_State

If I am trying to search, this query doesnt fit
message: "[Prometheus]: CRITICAL on 10"

While this one fits

message: "[Prometheus]: CRITICAL on "

So if I put number in search string, it fails. Any idea, pls?

thanks

Petr

Accepted answers

All comments

Rafael Meira_bepskb

Hello @Petr Novotny

OpsGenie uses the Elasticsearch Query String Query for its search functionality. This means that certain characters are reserved by Elasticsearch and have a special meaning. One of these is the ":" character, which is used for field search.

When you are using numbers or any character after ":", it is treated as a field search and OpsGenie is searching for a field called "10", not a string. That's why your search query with the number is not working.

You should escape the ":" character with double backslashes like so: "\\:". So your search string should be:

```
message: "[Prometheus]\\: CRITICAL on 10"
```

This would escape the ":" character and allow you to search with the number as part of the string.

I hope this helps.

Best,
Rafa

Bin

@Rafael MeiraI have a hyperlink in Description field. The end of URL is id=dddd. I want to search for the number dddd. I tried different syntax combination such as *9099* or "*9099" or *"9099", etc. None of them pulled any reason. The same number appears in Alias field too. The sample data is like:

XXX PRTG Hosted (xxxx.my-prtg.com)_Microsoft 365 Service Status (Microsoft 365 Service Status)_9099

This is not hyperlink but the similar searches on Alias field did not find anything.

Please advise. Thanks!!

Petr Novotny_2d0815

Hello Rafa,

thanks for your answer, unfortunately this is not working as expected.

As I wrote in my post, message: "[Prometheus]: CRITICAL on " works. Also message: "CRITICAL on" finds my alerts with ":" char in our alerts.

It wont find any alert if I include number in search string. So when I use message: "CRITICAL on 10", its giving nothing.

original alerts are "[Prometheus]: CRITICAL on 10.100.129.192:9104" and only IP address is changing.

regards

Petr

Petr Novotny_2d0815

I can see the possible culprit here is that IP is taken as a whole word "10.101.133.110:9104" and if we search just for a part of this word, like "10.101" it wont find anything

Rafael Meira_bepskb

@Petr Novotny

It seems like the IP address is treated as a whole term, and thus a search for a part of the IP won't return any results as there is no exact match.

There are a few ways that you could potentially work around this:

1. If you are aware of the exact IP that you want to search for, you could use that in your search term. For example: `message: "CRITICAL on 10.100.129.192:9104"`.

2. If you are looking for alerts from a range of IPs, you could potentially do a wildcard search. For example: `message: "CRITICAL on 10.*"`.

3. If the first two options are not suitable and you need to be able to search for parts of an IP, you might need to consider modifying the way your data is indexed. This could involve changing the way the data is tokenized, for example by using a custom tokenizer that splits the IP into separate terms.

I hope this helps.

Best,
Rafa

Rafael Meira_bepskb

You're welcome, @Petr Novotny let me know if I can assist you with anything else.

Best,

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

cloud

opsgenie