Unable to parse fields in incident rule

Shreya Karnelli

Hi Team, 

We tried creating incident using incident rule and email alert integration.

We are facing the following issues.

 

1. Unable to parse and choose from email subject line. In email we use "new incident reported - " in the beginning of subject line which cannot be removed here. so it has created incident with the same subject line.

2. Unable to parse and choose specific fields from email body. See for example in the following incident description we have fields marked in red which are unnecessary.

3. Unable to set priority by choosing a particular field from email body.

 

We would like to get in contact with the Opsgenie support for assistance and discuss the issues and know if anything can be done about this. 

Arkadiusz Wroblewski

Hello and welcome to the Community @Shreya Karnelli 

By default, Opsgenie uses the email subject as the alert message and the email body as the description. If the incoming email is HTML, Opsgenie also attaches the original email. So the subject prefix, the disclaimer/footer in the description, and the HTML attachment part are not something I would try to solve in the incident rule first.

I would move that logic into the Email integration under Advanced settings -> Create alert. That is the place where Opsgenie supports parsing and transforming email content. For priority, the parsed result must resolve to P1-P5. If not, Opsgenie falls back to P3, which matches what you are seeing. 

So my first question would be: are you still using the default Email integration mapping, or have you already customized the Create alert action there?