1. Home
  2. Alert Behavior
  3. Transmogrifier
  4. Transmogrifier: Matching Conditions

Transmogrifier: Matching Conditions

The matching condition will determine when this rule should be applied.  You can choose any field that exists within the payload of an alerts and match on a specific value for that field using a direct match or wildcard matching.

TransmogMatchingRule

When viewing an incident in the timeline, field names are on the left and values are on the right:

fieldAndValue

In the above example, the field of interest is the entity_id field and the value that matters is the phrase “disk space”.  The matching condition therefore is the following (wildcard matching used in this example, hence the * symbol).

matchingCondition2

Wildcard Matching

Rules can match on an alert field value using a simplified wildcard syntax to match some or all of the string. The “*” character matches 0 or more characters and the “?” character matches exactly one character. They can be used anywhere in the match pattern, as many times as needed.

Wildcard Examples:
PhraseMatchesDoes Not Match
db?.mydomain.tlddb2.mydomain.tld
dbx.mydomain.tld
db0.mydomain.tld
db.mydomain.tld
db14.mydomain.tld
db-main.mydomain.tld
*.mydomain.tldwww.mydomain.tld
www.subdomain.mydomain.tld
db778.mydomain.tld
mydomain.tld
x.mydomain.tld/with/a/long/path/suffix.html
db-???.*db-123.foobar.baz
db-abc.bazfoo.bar
db-abc123.foobaz.bar
db000.barfoo.baz
Updated on July 7, 2017

Was this article helpful?

Related Articles