Tigger Tags = regexp?

[Snoop]

Hi Zabbix Guru's

I am trying to Tag windows server event logs for account logins which has been working well, i have a template, item and trigger all set up and is pulling the log and triggering when it should,

what i would like to do now is tag the triggered event with the Account name of the person logging in,
I have been playing around with it and i can match a string in the event log and tag it with something pre programmed but am struggling to figure out how to pull the account name from the log and populate the tag name with that account name variable

Anyone know if this can be done?
Any Ideas?

My config
Zabbix 3.2.4
Item key = eventlog[Security,,,,4624,,skip]
Tigger = {Template Windows Logon Events:eventlog[Security,,,,4624,,skip].iregexp(Logon\s+Type:\s+2,#1)}=1
Tag = ???

Thanks

[ovas]

Hello!

You need to have a look at the macro support in triggers, you can assign them as values for tags. Since event log has a field named Account Name: <User>, you need to grab <User> field value. I took your own regex as a sample and modified as follows, place it in tag value field in Zabbix:
{{ITEM.VALUE}.iregsub(Account\s+Name:\s+"^[A-Za-z0-9]+",\1)}

More information available:

https://www.zabbix.com/documentation/3.2/manual/config/macros/macro_functions

https://www.zabbix.com/documentation/3.2/manual/config/event_correlation/trigger

https://www.zabbix.com/documentation/3.2/manual/config/triggers/event_tags