Multiple fields for email notification

abhishekgandhe — Tue, 29 Sep 2020 22:17:59 GMT

Following is my JSON data: -

{
"message": [
{
"raw": "04/12/18 14:03:56 [28] ERROR :: TenantId = model-cps-czooarea05nap01 :: JobId = 383d529e-4d7a-465d-8823-798d6e661788 :: CalcType = Process Monitor :: UniSimInvokerServices.HttpHelper : Complete Exception Details: System.Threading.Tasks.TaskCanceledException: A task was canceled.\r\n at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Net.Http.HttpClient.d_58.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter`1.GetResult()\r\n at UniSimInvokerServices.HttpHelper.d3.MoveNext() in C:\Users\E542204\Source\Repos\cps-unisim-taskexecutor\Honeywell.PMT.UOP.CPS.UniSimInvoker\HttpHelper.cs:line 66",
"severityLevel": "Error",
"className": "UniSimInvokerServices.HttpHelper+d3",
"methodName": "MoveNext",
"lineNumber": 115,
"domain": "Honeywell.PMT.UOP.CPS.UniSimTaskService.exe",
"loggerName": "UTELogger",
"threadName": "28"
}
],
"internal": {
"data": {
"id": "7f55dcd3-f7cd-11e8-b587-fb20626c7e32",
"documentVersion": "1.61"
}
},
"context": {
"data": {
"eventTime": "2018-12-04T14:03:56.7939778Z",
"isSynthetic": false,
"samplingRate": 100
},
"cloud": {},
"device": {
"type": "PC",
"roleInstance": "usd-qa-wk1-eus",
"screenResolution": {}
},
"session": {
"isFirst": false
},
"operation": {},
"location": {
"clientip": "0.0.0.0",
"continent": "North America",
"country": "United States",
"province": "Virginia",
"city": "Boydton"
},
"custom": {
"dimensions": [
{
"TenantId": "model-cps-czooarea05nap01"
},
{
"LoggerName": "UTELogger"
},
{
"CalcType": "Process Monitor"
},
{
"JobId": "383d529e-4d7a-465d-8823-798d6e661788"
},
{
"MethodName": "MoveNext"
},
{
"LineNumber": "115"
},
{
"Domain": "Honeywell.PMT.UOP.CPS.UniSimTaskService.exe"
},
{
"ThreadName": "28"
},
{
"ClassName": "UniSimInvokerServices.HttpHelper+d_3"
},
{
"FileName": "C:\Users\E542204\Source\Repos\cps-unisim-taskexecutor\Honeywell.PMT.UOP.CPS.UniSimInvoker\HttpHelper.cs"
}
]
}
}
}

I want to use the fields - TenantId, CalcType, ClassName, eventTime - in the email notification.
How to use these fields in email alert? What will be search string for such scenario?

Re: Multiple fields for email notification

dkeck — Wed, 05 Dec 2018 10:47:16 GMT

Hi,

it would be easier to help with more information. Do you already have those fileds extracted in your index?

What do you want to alert on, when a certain values shows up in those fields etc.?

Kind Regards

Re: Multiple fields for email notification

abhishekgandhe — Thu, 06 Dec 2018 03:37:05 GMT

This is the search string: -

index=cpsprod sourcetype="mscs:storage:blob:cps-prod-unisim-taskexecutor" "message{}.severityLevel"=Error "context.data.eventTime"="" "context.custom.dimensions{}.CalcType"="" "context.custom.dimensions{}.TenantId"="*"

I am getting eventTime using $result.context.data.eventTime$.
Not getting values for $result.context.custom.dimensions{}.TenantId$ and $result.context.custom.dimensions{}.CalcType$

Re: Multiple fields for email notification

martin_mueller — Thu, 06 Dec 2018 14:48:46 GMT

It's plausible that curly braces don't work in token names - if that's the case do rename the fields at the end of your search and use the cleaned names in your email tokens.

topic Multiple fields for email notification in Deployment Architecture

Multiple fields for email notification

Re: Multiple fields for email notification

Re: Multiple fields for email notification

Re: Multiple fields for email notification