How to parse the subject and the properties from aws cloudwatch payload?

[pushpa]

I can't see the value for "Subject" in parsed date for my cloudwatchEvent integration. It shows as null. How can I get the value for "subject" in these alerts.  

Also, I want to parse the properties like "resources" from the payloads received from aws cloudwatchEvent. Is there any way I can parse any extra properties other than the mentioned above (i.e. reason, deploymentid, eventname, eventtype, source etc.). Subject is also null. Not sure how to parse any value to subject? 

Can someone please help me in resolving the above issue.

[Nick Haller · Accepted solution]

Hi @pushpa ,

Not entirely sure why the Subject field is included as a default field parsing in the payload, since it's not included as one in the CloudWatch Events integration:

Which is why I assume it's sending as null. It is a default field in the other CloudWatch integration, so maybe that's the reason.

As for extracting the other fields being parsed in the payload, most customers will use a form of string processing or regex to extract these into the alert.

You might be able to use something like one of these:

{{_payload.reason}}

{{_payload.substringBetween("\"reason\":\"","\"")}} 

[pushpa]

Thanks Nick. I tried something like the above.

[Nick Haller]

It looks like the resources field parses a bracket which is a different formatting than the reasons field:

So the resources field might be something like:

{{_payload.resources}}

{{_payload.substringBetween("\"resources\":[\"","\"]")}}

[pushpa]

Thanks. I was also working on that and just got the things correctly.

Thanks for your help Nick.