There is an option to define custom event tags in Zabbix. Event tags are defined on the trigger level. After the tags are defined, corresponding new events get marked with tag data.
Having custom event tags allows for more flexibility. For example, actions can be defined based on event tags.
Event tags are realized as a pair of the tag name and value. You can use only the name or pair it with a value:
Some use cases for this functionality are as follows:
* Define tags in the log trigger that will identify events using value extraction by the %%{{%%ITEM.VALUE<N>}.regsub()} macro;
* In trigger configuration, have multiple problem event generation mode;
* In trigger configuration, use [[:manual/config/event_correlation|event correlation]]: select the option that OK event closes only matching events and choose the tag for matching;
* See problem events created with a tag and closed individually.
- Use it to filter notifications
* Define tags on the trigger level to mark events by different tags;
* Use tag filtering in action conditions to receive notifications only on the events that match tag data.
- See event tag information in the frontend
* Define tags on the trigger level to mark events by different tags;
* See this information in //Monitoring// → //Problems//.
- Use information extracted from item value as tag value
* Use an %%{{%%ITEM.VALUE<N>}.regsub()} macro in the tag value;
* See tag values in //Monitoring// → //Problems// as extracted data from item value.
- Identify problems better in notifications
* Define tags on the trigger level;
* Use an {EVENT.TAGS} macro in the problem notification;
* Easier identify which application/service the notification belongs to.
- Simplify configuration tasks by using tags on the template level
* Define tags on the template trigger level;
* See these tags on all triggers created from template triggers.
- Create triggers with tags from low-level discovery (LLD)
* Define tags on trigger prototypes;
* Use LLD macros in the tag name or value;
* See these tags on all triggers created from trigger prototypes.
Event tags are defined in trigger configuration. Event tags can be defined for triggers, template triggers and trigger prototypes.
{ITEM.VALUE} and {ITEM.LASTVALUE} macros can be used to populate the tag name or tag value.
User macros and user macro context is supported for the tag name/value since Zabbix 3.2.2. User macro context may include low-level discovery macros.
Low-level discovery macros can be used for the tag name/value in trigger prototypes.
{EVENT.TAGS} and {EVENT.RECOVERY.TAGS} macros can be used in trigger-based notifications and they will resolve to a comma separated list of event tags or recovery event tags.
Substring extraction is supported to populate the tag name or tag value, using the new macro function - applying a regular expression to the value obtained by the {ITEM.VALUE} macro.
Tag name and value will be cut to 255 characters if their length exceeds 255 characters after macro resolution.
Event tags, if defined, can be seen with new events in:
Only the first three tag entries are displayed. If there are more than three tag entries, it is indicated by three dots. If you roll your mouse over these three dots, all tag entries are displayed in a pop-up window.