How to Set an Opsgenie Alias Field with String Processing

[#1]

The alias field in Opsgenie is used to match actions on an integration to the correct alert. 

Please note that these instructions only apply to the Standard and Enterprise plans. The Essentials plan does not support Advanced integration settings.

For pricing and plan feature information, please refer to our pricing page.

If a monitoring tool can send both alarm and recovery emails, Opsgenie can automatically close the alerts with some extra setup. This is mostly a two-step process. The following example is for the email integration but can be applied to many of our integrations.

First, decide on CREATE and CLOSE keywords in the email. This is most often either a flat UP/DOWN status or a severity like CRITICAL/WARNING/OK. In this example, my printer sends an email when it’s out of paper - here’s the message body: 

The <Status Notification> is always at the top of the email and is a good keyword for the Create Alert action:
​

Once the printer has paper again, it sends a similar email except the <Status Notification> is replaced by <Restoration Notification>:  

Using that for the Close Alert action will work too: 

Next, set the integration’s alias field so that Opsgenie can find the matching open alert when a recovery message is received. Without this step, Opsgenie would see <Restoration Notification> and attempt to close an alert, but it won’t know which alert to close. 

Usually fields like hostname, IP address, service name, or a combination work well for the alias. We’ll use string processing to make one for my printer using a couple of pieces of the email.

​Piece 1 - Hostname: This is a good place to start since it makes the alert unique to each printer. That is, if multiple printers are out of paper at the same time they will each create their own alert. 

In the email, we have this line: "Name: office_printer"

substringAfter() works well here since it’s all on one line: 

{{message.substringAfter("Name: ")}}
​
We can also get the same result with extract(): 

{{message.extract(/Name: (\S+)/)}}

Piece 2 - Service Name: Combining this with the hostname ensures I can still get alerts for other types of issues with the same printer. 

In the email, we have this line: "The device status is [No Paper]"

Here "No Paper" is what we want to extract - but really we want whatever is between those brackets: 

{{message.substringBetween("[","]")}}

Again, we can get the same result with extract() too: 

{{message.extract(/\[([\S ]+)\]/)}}

Remember to change the alias for create AND close actions of the integration!

After setting up the alert’s action filters and alias I don’t have to bother going into Opsgenie to close the alert after putting more paper in the printer - Opsgenie can take care of that for me. More importantly, it keeps the alert dashboard clean and manageable without any extra effort by a user.

For more options available via string processing, please review this doc.

In order to ensure that we continue to provide useful content, please let us know if this Article is helpful (Thumbs Up/Down). Also, to help us improve, feel free to provide additional feedback (directly in the community).