Configure an event rule to customize alert content

You can configure an event rule to customize alert content. You can customize the order of the fields and select which fields display. The fields in the left-hand workarea of the Transform and compose alert output section of an event rule are the fields that appear in the generated alert.

Before you begin

Role required: evt_mgmt_admin or evt_mgmt_operator

About this task

You can customize alert content by adding the required event fields and modifying the text in the fields. Format alert text by using one or both of these methods:
Table 1. Format alert text
Format method Description
Transform Create a new field to display in an alert. The field and its value display in the Additional Information section of an alert. In the Event Input pane, the new field is listed in the EXPRESSIONS section.
Compose Determine which text to display in the selected field.
Note:
  • Configure which fields display in the Event Input pane by configuring the blacklist [em_event_rule_black_list].
  • Control the order of event form fields by configuring em_event_rule_order.

Procedure

  1. Navigate to Event Management > Rules > Event Rules.
  2. Click New or open an event rule.
  3. ClickTransform and compose alert output. In this section, you can use the Transform mode and the Compose mode.
  4. To transform information in fields - standard mode:
    Note: In this step, the selection of text is made in standard edit mode. In this mode, undo is available.
    1. Click the required field in the Event Input pane. The value and contents of the selected field display in the workarea on the left.

    2. Select standard edit mode .
    3. Select the required text. You can double-click text in the field to select a word or select the required text and symbols.

    4. Select a field name from the list or enter the required expression name. The field name displays in the Expressions pane and the selected text is highlighted. Both the text and the expression name are highlighted in the same color. Each additional expression that you create, plus its value, is highlighted in a different color.
      Note: Transform field names cannot contain a ‘ (single quote) character.
    5. Click Done. The expression name displays in the EXPRESSIONS section of the Event Input pane.

    6. If you click an expression or its value in the Event Input pane, the details display in the workarea on the left.
  5. To transform information in fields - regex mode:
    Note: In regex mode undo is not available.
    1. Click the required field in the Event Input pane. The value and contents of the selected field display in the workarea on the left.
    2. Select regex edit mode .

    3. Select the required text and symbols . Replace the highlighted text with (.*) to create a regex expression.
    4. In the Expressions pane, click the Select or Add Field field and select a field name from the list or enter the required expression name.

    5. Click Done.
  6. To compose text, in the Transform and compose alert output section, click in the required field.

    Compose text in the alert fields by performing any of these actions:

    • Drag a field from the Event Info pane into the required field.
    • Use the Event Info pane as a reference of which fields are available and write the field name details, using the format ${<fieldname>}, where "$" means "use the value" and between the brackets, the name of the event field replaces the <fieldname> variable.
    • Freely enter text, spaces or characters. For example, use spaces or underscore symbols (_) to make the text in the alert field readable.
  7. Select Manual attributes to specify fields that must display in the generated alert. These fields, and their values, display in the Additional Information section of the generated alert.
  8. Click Save or Update.

What to do next

You can filter event rules. See Filter event rules.