How to Extract Custom Fields and Data into an Alert

[#1]

This article outlines how to extract fields and data into an alert that are not offered through an integration by default.

The Advanced tab of an integration shown below is only available only on the standalone Opsgenie Standard and Enterprise plans, and the JSM/O Premium and Enterprise plans.

These methods can still be applied to extract fields and data into the tags or extra properties fields on the Opsgenie Free and Essentials plans, and the JSM/O Free and Standard plans:

If a field and/or data is being parsed in the payload, it can be extracted into an alert using string processing or regular expressions (regex).

Each Opsgenie integration offers a number of draggable dynamic fields. These can be added into an alert to parse data and construct rich, informative, customized alerts.

Some 3rd party sources send custom fields to Opsgenie which are not offered through an integration by default. As long as the field is being parsed in the payload, it can be extracted into Opsgenie alert fields using string processing or regex.

Where to check:

If a field is not parsed into an alert as expected, check the Logs Tab to review whether or not it was parsed in the payload. 

Logs can be searched by timestamp and/or strings. Specifically the Processed incomingData and Received integration request logs will show what data is being parsed in the payload:

With some integrations such as Jira and JSM, workflows require custom fields to be entered when creating an issue. These custom fields are not included by default in the Jira and JSM integrations, but still parse in the payload of the alert:

Note - There are some limits to the Logs where data parsed can be truncated:

With cases like this it’s best to extract the entire payload into the alert’s description field (which has a max character limit of 15000 characters). This can be done under the Advanced tab of an integration using {{_payload}} to determine if the custom field is being parsed in the payload, and can then be extracted into the alert:

Leveraging a JSON formatter can be an easier way to understand the formatting of how a field is being parsed:

As shown above, the custom field is nested. A dynamic field such as:

{{_payload.issue.fields.customfield_10048}}

can then be used to extract the value into an alert field(s): 

* Since Jira, JSM and other integrations format data and custom fields differently through nesting, lists, arrays, webhook URL, headers, etc. it depends on how the field is being parsed in the payload.

Again - as long as a field and/or data is being parsed in the payload, it can be extracted into the alert using string processing or regex:

Other:

In regard to Jira and JSM, customers have leveraged some of these options to extract a custom field:

Legacy Integration:

{{_payload.issue.fields.customfield_00000}}

{{_payload.issue.fields.customfield_00000.name}} 

{{_payload.issue.fields.customfield_00000.value}}

{{_payload.issue.fields.customfield_00000.substringBetween("value=",",")}}

{{_payload.issue.fields.substringBetween("customfield_00000=",",")}}

Cloud Integration:

{{customFields.customfield_00000}}

{{customFields.customfield_00000.name}} 

{{customFields.customfield_00000.value}}

{{customFields.customfield_00000.substringBetween("value=",",")}}

In order to ensure that we continue to provide useful content, please let us know if this Article is helpful (Thumbs Up/Down). Also, to help us improve, feel free to provide additional feedback (directly in the community).

[Nick Haller]

* Zendesk is one example of an integration that parses data different than Jira and JSM.

Instead of parsing data through {{_payload}}, Zendesk parses the payload in the _httpParams or {{_url}} object:

To extract a custom field such as the requester_email above, I could use a string processing method such as {{_url.ticket.substringBetween("requester_email:"," |") }}.

This custom field is included in the entirety of the ticket field, which is also nested under the _httpParams or {{_url}}:

Documentation: Using Raw Parameters From Webhook Url, Payload and Headers

[Ian Tait]

@Nick Haller Where can I find a list of possible operations for alert fields template? Like the `extract` and `substringBetween` functions, I would like to see a full list of operations that are possible for alert field values.

EDIT: Nevermind, I just found the link on your last comment :facepalm:

[Volkan Sutcu]

@Nick Haller Thank you very much for the tips. I was trying to get the tags details from an integration request under _httpParams and with your technique, it works perfectly ! 

[Karoline Rezende Ramos]

Hi Community!

The article is excellent.

But I have a related question.

I'm trying to copy the value of a Select List (multiple choices) field, I've already used the expressions but it's a code and not the value of the actual field, does anyone know how I can do this?
I would like to bring the value of this custom field to the "ALIAS" field of the alert, because later I will use it as a condition when choosing escalations policies.

I've already tried these ways:

{{_payload.issue.fields.customfield_00000}}

{{_payload.issue.fields.customfield_00000.name}} 

{{_payload.issue.fields.customfield_00000.value}}

@Nick Haller

Can you help me? 😃