Multiple fields for email notification

[abhishekgandhe]

Following is my JSON data: -

{
"message": [
{
"raw": "04/12/18 14:03:56 [28] ERROR :: TenantId = model-cps-czooarea05nap01 :: JobId = 383d529e-4d7a-465d-8823-798d6e661788 :: CalcType = Process Monitor :: UniSimInvokerServices.HttpHelper : Complete Exception Details: System.Threading.Tasks.TaskCanceledException: A task was canceled.\r\n at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Net.Http.HttpClient.d_58.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter`1.GetResult()\r\n at UniSimInvokerServices.HttpHelper.d3.MoveNext() in C:\Users\E542204\Source\Repos\cps-unisim-taskexecutor\Honeywell.PMT.UOP.CPS.UniSimInvoker\HttpHelper.cs:line 66",
"severityLevel": "Error",
"className": "UniSimInvokerServices.HttpHelper+d3",
"methodName": "MoveNext",
"lineNumber": 115,
"domain": "Honeywell.PMT.UOP.CPS.UniSimTaskService.exe",
"loggerName": "UTELogger",
"threadName": "28"
}
],
"internal": {
"data": {
"id": "7f55dcd3-f7cd-11e8-b587-fb20626c7e32",
"documentVersion": "1.61"
}
},
"context": {
"data": {
"eventTime": "2018-12-04T14:03:56.7939778Z",
"isSynthetic": false,
"samplingRate": 100
},
"cloud": {},
"device": {
"type": "PC",
"roleInstance": "usd-qa-wk1-eus",
"screenResolution": {}
},
"session": {
"isFirst": false
},
"operation": {},
"location": {
"clientip": "0.0.0.0",
"continent": "North America",
"country": "United States",
"province": "Virginia",
"city": "Boydton"
},
"custom": {
"dimensions": [
{
"TenantId": "model-cps-czooarea05nap01"
},
{
"LoggerName": "UTELogger"
},
{
"CalcType": "Process Monitor"
},
{
"JobId": "383d529e-4d7a-465d-8823-798d6e661788"
},
{
"MethodName": "MoveNext"
},
{
"LineNumber": "115"
},
{
"Domain": "Honeywell.PMT.UOP.CPS.UniSimTaskService.exe"
},
{
"ThreadName": "28"
},
{
"ClassName": "UniSimInvokerServices.HttpHelper+d_3"
},
{
"FileName": "C:\Users\E542204\Source\Repos\cps-unisim-taskexecutor\Honeywell.PMT.UOP.CPS.UniSimInvoker\HttpHelper.cs"
}
]
}
}
}

I want to use the fields - TenantId, CalcType, ClassName, eventTime - in the email notification.
How to use these fields in email alert? What will be search string for such scenario?

[dkeck]

Hi,

it would be easier to help with more information. Do you already have those fileds extracted in your index?

What do you want to alert on, when a certain values shows up in those fields etc.?

Kind Regards

[martin_mueller]

It's plausible that curly braces don't work in token names - if that's the case do rename the fields at the end of your search and use the cleaned names in your email tokens.

[abhishekgandhe]

This is the search string: -

index=cpsprod sourcetype="mscs:storage:blob:cps-prod-unisim-taskexecutor" "message{}.severityLevel"=Error "context.data.eventTime"="" "context.custom.dimensions{}.CalcType"="" "context.custom.dimensions{}.TenantId"="*"

I am getting eventTime using $result.context.data.eventTime$.
Not getting values for $result.context.custom.dimensions{}.TenantId$ and $result.context.custom.dimensions{}.CalcType$