How to use the "contains" filter on a policy to match alerts on tags?

[Jonathan Ballet]

Hi,

I'm trying to define a new "delay" policy that would delay until the next morning my alerts that have a tag that contains the "test" string.

I created the policy as shown in the picture below:

I'm using Lamp to test my alerts:

• If I send an alert with:

  opsgenie-lamp createAlert --message "hello world" --tags "test"

  Then the filter matches, and my alert is correctly delayed.
• If I send an alert with:

  opsgenie-lamp createAlert --message "test jon" --tags "test 123"

  Then the filter doesn't match, the alert is not delayed and I'm paged instantly. I tried various combination of the tag value: "test123", "test-123", "test 123", the filter doesn't match.

I could use a regex for that, but I wanted to be sure I understood "contains" correctly (does it actually mean "equal"?)

Thanks for your help!

[Nick H · Accepted solution]

Hi @Jonathan Ballet ,

When filtering by tags and/or teams, please use the 'contains' operator and enter the full tag/team name. These two attributes are list attributes and the 'contains' operator would search for the specific tag/team typed within the list: https://docs.opsgenie.com/docs/terminology-and-capabilities-of-the-reporting-page#advanced-capabilities

^ Although the doc outlines this in reporting, the same goes for filtering tags in policies, integrations, etc. 

Regex can also be used like you mentioned as well! Hope this helps. Let us know if you have any other questions around this.

[Jonathan Ballet]

Hi @Nick H

Thanks for your answer! If I understand correctly, "contains" is for when there's a list of values, such as a list of tags, and the filter would lookup one of the value of the list, right?

It possible to combine both behaviors? Ideally, Id' like to filter my alerts if any of the tags value matches the regexp ".*test.*", would that work?

[Nick H]

That's correct. Tags will always be in a list since they are parsed as an array in the payload. Regex can act like the "contains" condition using an expression like yours.

For example with the test below (no pun intended) - I have a policy that filters using regex, and applies to alerts that match .*(test).* in the tag.

I even added "test" in the middle of the tag to show how it can act like "contains" in this example: thisisatestforjb

[Jonathan Ballet]

@Nick H Thanks a lot, I'll try with this type of filters then!