Multi-line regex on discovery rule not working, only first line OK

[Adriano Trindade]

Hello!

I'm using Zabbix 6.0.2 and facing a problem hard to solve.

One item in a host obtains a list of parameters from a device, using a SSH script. The return text is the following:

0 mdisk0 online 0 Pool600Gb 744.2GB online raid5 1 256 tier0_flash no no
1 mdisk3 online 1 Pool800Gb 744.2GB online raid5 1 256 tier0_flash no no
2 mdisk7 online 2 Pool1Tb 1.1TB online raid1 1 256 tier_enterprise no no
3 mdisk1 online 0 Pool600Gb 6.0TB online raid6 2 256 tier_enterprise no no
4 mdisk2 online 0 Pool600Gb 5.4TB online raid6 2 256 tier_enterprise no no
5 mdisk4 online 1 Pool800Gb 9.0TB online raid6 2 256 tier_enterprise no no
6 mdisk5 online 1 Pool800Gb 8.1TB online raid6 2 256 tier_enterprise no no
7 mdisk6 online 1 Pool800Gb 8.1TB online raid6 2 256 tier_enterprise no no

Once I have this data stored on a item, I create a discovery rule of "dependent" type pointing to this item. This discovery rule has to obtain the ID of each line (first number of the line) using regex, and create one set of discovered itens relative to each line. This regex need to enclose the results in JSON format. The regex on the discovery rule is the following:



Testing it using regex101, the result is exactly the expected. But, on regex101 site, there are the "global" and "multiline" options. I can enable multiline using the "(?m)" modifier, but not global.




I turn the regex JSON result into a macro to be used on the dependent itens, using an LLD macro, and it works well.


Each item prototype is an dependent item (master is the text item of the host), have it's own preprocessing regex in order to extract relevant data to the item.




Everything is working. Items are created with the correct data. My problem is that only the first line of the text data is processed. Only the ID 0.

What I'm doing wrong? What I need to change in order for the discovery rule to go through the other lines?

Thanks in advance,

[cyber]

Preprocessing with regex works only on single line (with some exceptions using [[:space:]]) .. It is not meant to return a whole modified array... And in this case, you feed your data to preprocessor, and you get out only first match (not even full line any more), your LLD cannot even see more, as it is not there any more.

What you should do, is first run CSV to JSON preprocessing (without header)...
you will get something like this..

[
{"1":"0","2":"mdisk0","3":"online","4":"0","5":"Po ol600Gb","6":"744.2GB","7":"online","8":"raid5","9 ":"1","10":"256","11":"tier0_flash","12":"no","13" :"no"},
{"1":"1","2":"mdisk3","3":"online","4":"1","5":"Po ol800Gb","6":"744.2GB","7":"online","8":"raid5","9 ":"1","10":"256","11":"tier0_flash","12":"no","13" :"no"},
{"1":"2","2":"mdisk7","3":"online","4":"2","5":"Po ol1Tb","6":"1.1TB","7":"online","8":"raid1","9":"1 ","10":"256","11":"tier_enterprise","12":"no","13" :"no"},
{"1":"3","2":"mdisk1","3":"online","4":"0","5":"Po ol600Gb","6":"6.0TB","7":"online","8":"raid6","9": "2","10":"256","11":"tier_enterprise","12":"no","1 3":"no"},
{"1":"4","2":"mdisk2","3":"online","4":"0","5":"Po ol600Gb","6":"5.4TB","7":"online","8":"raid6","9": "2","10":"256","11":"tier_enterprise","12":"no","1 3":"no"},
{"1":"5","2":"mdisk4","3":"online","4":"1","5":"Po ol800Gb","6":"9.0TB","7":"online","8":"raid6","9": "2","10":"256","11":"tier_enterprise","12":"no","1 3":"no"},
{"1":"6","2":"mdisk5","3":"online","4":"1","5":"Po ol800Gb","6":"8.1TB","7":"online","8":"raid6","9": "2","10":"256","11":"tier_enterprise","12":"no","1 3":"no"},
{"1":"7","2":"mdisk6","3":"online","4":"1","5":"Po ol800Gb","6":"8.1TB","7":"online","8":"raid6","9": "2","10":"256","11":"tier_enterprise","12":"no","1 3":"no"}
]

and then create your LLD macros based on that

[cyber]

Preprocessing with regex works only on single line (with some exceptions using [[:space:]]) .. It is not meant to return a whole modified array... And in this case, you feed your data to preprocessor, and you get out only first match (not even full line any more), your LLD cannot even see more, as it is not there any more.

What you should do, is first run CSV to JSON preprocessing (without header)...
you will get something like this..

[
{"1":"0","2":"mdisk0","3":"online","4":"0","5":"Po ol600Gb","6":"744.2GB","7":"online","8":"raid5","9 ":"1","10":"256","11":"tier0_flash","12":"no","13" :"no"},
{"1":"1","2":"mdisk3","3":"online","4":"1","5":"Po ol800Gb","6":"744.2GB","7":"online","8":"raid5","9 ":"1","10":"256","11":"tier0_flash","12":"no","13" :"no"},
{"1":"2","2":"mdisk7","3":"online","4":"2","5":"Po ol1Tb","6":"1.1TB","7":"online","8":"raid1","9":"1 ","10":"256","11":"tier_enterprise","12":"no","13" :"no"},
{"1":"3","2":"mdisk1","3":"online","4":"0","5":"Po ol600Gb","6":"6.0TB","7":"online","8":"raid6","9": "2","10":"256","11":"tier_enterprise","12":"no","1 3":"no"},
{"1":"4","2":"mdisk2","3":"online","4":"0","5":"Po ol600Gb","6":"5.4TB","7":"online","8":"raid6","9": "2","10":"256","11":"tier_enterprise","12":"no","1 3":"no"},
{"1":"5","2":"mdisk4","3":"online","4":"1","5":"Po ol800Gb","6":"9.0TB","7":"online","8":"raid6","9": "2","10":"256","11":"tier_enterprise","12":"no","1 3":"no"},
{"1":"6","2":"mdisk5","3":"online","4":"1","5":"Po ol800Gb","6":"8.1TB","7":"online","8":"raid6","9": "2","10":"256","11":"tier_enterprise","12":"no","1 3":"no"},
{"1":"7","2":"mdisk6","3":"online","4":"1","5":"Po ol800Gb","6":"8.1TB","7":"online","8":"raid6","9": "2","10":"256","11":"tier_enterprise","12":"no","1 3":"no"}
]

and then create your LLD macros based on that

[Adriano Trindade]

Hello!

Thanks on your response. I used CSV to JSON preprocessing after adjusting the original command sent to the device and obtained good results.

[{"mdisk_id":"0","mdisk_name":"mdisk0","status":"on line","mdisk_grp_id":"0","mdisk_grp_name":"Pool600 Gb","capacity":"744.2GB","raid_status":"online","raid_level":"raid5","redundancy":"1","strip_size":" 256","tier":"tier0_flash","encrypt":"no","distribu ted":"no"},
{"mdisk_id":"1","mdisk_name":"mdisk3"," status":"online","mdisk_grp_id":"1","mdisk_grp_nam e":"Pool800Gb","capacity":"744.2GB","raid_status": "online","raid_level":"raid5","redundancy":"1","strip_size":"256","tier":"tier0_flash","encrypt":"no ","distributed":"no"},
{"mdisk_id":"2","mdisk_name" :"mdisk7","status":"online","mdisk_grp_id":"2","md isk_grp_name":"Pool1Tb","capacity":"1.1TB","raid_status":"online","raid_level":"raid1","redundancy": "1","strip_size":"256","tier":"tier_enterprise","encrypt":"no","distributed":"no"},
{"mdisk_id":"3"," mdisk_name":"mdisk1","status":"online","mdisk_grp_ id":"0","mdisk_grp_name":"Pool600Gb","capacity":"6 .0TB","raid_status":"online","raid_level":"raid6", "redundancy":"2","strip_size":"256","tier":"tier_enterprise","encrypt":"no","distributed":"no"},
{"mdisk_id":"4","mdisk_name":"mdisk2","status":"online ","mdisk_grp_id":"0","mdisk_grp_name":"Pool600Gb", "capacity":"5.4TB","raid_status":"online","raid_level":"raid6","redundancy":"2","strip_size":"256"," tier":"tier_enterprise","encrypt":"no","distributed":"no"},
{"mdisk_id":"5","mdisk_name":"mdisk4","status":"online","mdisk_grp_id":"1","mdisk_grp_name" :"Pool800Gb","capacity":"9.0TB","raid_status":"online","raid_level":"raid6","redundancy":"2","strip_ size":"256","tier":"tier_enterprise","encrypt":"no ","distributed":"no"},
{"mdisk_id":"6","mdisk_name" :"mdisk5","status":"online","mdisk_grp_id":"1","md isk_grp_name":"Pool800Gb","capacity":"8.1TB","raid _status":"online","raid_level":"raid6","redundancy ":"2","strip_size":"256","tier":"tier_enterprise", "encrypt":"no","distributed":"no"},
{"mdisk_id":"7" ,"mdisk_name":"mdisk6","status":"online","mdisk_gr p_id":"1","mdisk_grp_name":"Pool800Gb","capacity": "8.1TB","raid_status":"online","raid_level":"raid6 ","redundancy":"2","strip_size":"256","tier":"tier _enterprise","encrypt":"no","distributed":"no"}]

With this I think I can move forward, it's way better to work than using regex.

Thanks for your help!