How to use specific information out of en event as a "tag"?

[AngryAdmin]

Hello there,

i have a event log of Veeam, where i try to monitor event 190. My Problem is, that I have multiple Job which means that one job could fail, and because another one finishes with success, it will recover the state of the check to OK.

I figured out, that there are tags : 6 Tagging (zabbix.com)

1. Use information extracted from item value as tag value:
   • Use an {{ITEM.VALUE<N>}.regsub()} macro in the tag value;
   • See tag values in Monitoring → Problems as extracted data from the item value.

What i did is, to create a regex that would find the Jobname in a line like "Bla bla bla 'Jobname' bla bla bla"

Then i added a marker to my trigger :

Name: Jobname
Value :{{ITEM.VALUE<N>}.regsub('(.*?)')}

But my tag doesn't seem to get added.

My idea is to change the state, only if the marker is the same on the failed and success event, which is the Jobname.

I think I misunderstood the documentation somewhere?
Can anybody explain how i can to that?

Thank you.

[ISiroshtan]

Hey.

I'm not 100% sure what is the end result you aiming for. So I will drop some guidelines based on how I understood what you want to achieve and you feel free to correct me with more details.

As I understand you have 1 item that collects messages from some system. And this messages can be either "Job X is OK" or "Job X is FAILED" (or something along the same logic). You have alerting in place to fire when message contains "FAILED" and resolve alert when messages contains "OK". Problem is X can be different, and as result one job failing will create alert but any other job running in parallel finishing fine will close this alert. So you want to teach Zabbix to distinguish which X is failing, and keep alert open until that specific X is in OK state.

If above is a correct understanding - continue reading. If it's wrong - disregard all below and try explain the question again


General direction you are taking is correct, but there are some mistakes in what you already have shown (unless you did mistakes in forum message but not in configuration... I'd say it's better to add screenshots of configuration instead of typing it manually).

Firstly:

Value :{{ITEM.VALUE<N>}.regsub('(.*?)')}

the N in {ITEM.VALUE<N>} macro should be replaced by the positional number of item you want to extract value from inside the trigger expression. If you have only one item in your trigger then just use

{ITEM.VALUE}

If you have multiple items in your trigger expression then just add number. For example if you have trigger

last(X)=0 and last(Y)="problem"

then to take regex value from Y use macro

{ITEM.VALUE2}

Secondly:

I questions your regsub function. Where is the output clause? Please reference Macro Functions documentation. The syntax is

regsub(<pattern>,<output>)

So as minimum I would expect end result for your tag value configuration to be like

{{ITEM.VALUE1}.regsub('(.*?)',\1)}

(also I always struggle with quotation in Zabbix, if it does not work I would suggest to replace single quotes ' ' with double quotes " " in example above)

And going a bit ahead of time, after you set the Tag you will need to ensure that "Problem event generation" is set to "Multiple" and that "OK even closes" set to "All problems if tag values match" and then "Tag for matching" is set as "Jobname".