Zabbix Documentation 3.2 (current)In development:4.2 (devel)Unsupported:

User Tools

Site Tools



9 Event tags


There is an option to define custom event tags in Zabbix. Event tags are defined on the trigger level. After the tags are defined, corresponding new events get marked with tag data.

Having custom event tags allows for more flexibility. For example, actions can be defined based on event tags.

Event tags are realized as a pair of the tag name and value. You can use only the name or pair it with a value:

MySQL, Service:MySQL, Services, Services:Customer, Applications, Application:Java, Priority:High 

Use cases

Some use cases for this functionality are as follows:

  1. Identify problems in a log file and close them separately

Macro support

{ITEM.VALUE} and {ITEM.LASTVALUE} macros can be used to populate the tag name or tag value.

User macros and user macro context is supported for the tag name/value since Zabbix 3.2.2. User macro context may include low-level discovery macros.

Low-level discovery macros can be used for the tag name/value in trigger prototypes.

{EVENT.TAGS} and {EVENT.RECOVERY.TAGS} macros can be used in trigger-based notifications and they will resolve to a comma separated list of event tags or recovery event tags.

Substring extraction

Substring extraction is supported to populate the tag name or tag value, using the new macro function - applying a regular expression to the value obtained by the {ITEM.VALUE} macro.

{{ITEM.VALUE}.regsub(pattern, output)}
{{ITEM.VALUE}.iregsub(pattern, output)}

Tag name and value will be cut to 255 characters if their length exceeds 255 characters after macro resolution.

Viewing event tags

Event tags, if defined, can be seen with new events in:

  • MonitoringProblems
  • MonitoringProblemsEvent details

Only the first three tag entries are displayed. If there are more than three tag entries, it is indicated by three dots. If you roll your mouse over these three dots, all tag entries are displayed in a pop-up window.

Performance and storage effects

It is expected that the use of event tags may have the following effects:

  • Event processing will be slower due to the creation of new records in the event tag table.
  • Operations related to manipulations with triggers inherited from templates will be slower since it's necessary to create one record per tag in the trigger tag table. Therefore the creation, update and removal of triggers will be slower.
  • Synchronization of configuration cache will be slower due to trigger tags.
  • Storage of event tags will require additional disk space which may be comparable to the size of existing trigger and event tables. Precise storage requirements depend very much on the number of tags created per trigger and event.