Trigger-based event correlation - EVENT TAGS ISSUES

[karmukis]

Hello everyone,
I've been dealing with an issue regarding event tags.

We created this base escenario, very simple, in which an nginx with 3 webservers write the sites messages to the same log, and we creted 1 item which checks the state of the sites giving the following OUTPUT for the item:
(The item works ok)

```
Service boat is down 404 Not Found

Service appletree is online, 200 OK

Service fireplace is down 404 Not Found
```


Then, we have a trigger which checks for value "404", when this value is found then the trigger starts the problem, and here is where we found ourselves in problem, the tag is not working. See image attach (trigger-conf.png)
The trigger is configure like this:




NAME: Service {{ITEM.VALUE}.regsub("((?<=Service\s).*(?=\sis down))","\1")} stopped #THIS WORKS!, the name of the trigger shows up like "Service boat stopped"
Expression: {kaku-template-test:hostcheck.sh["boat appletree fireplace"].regexp("404")}>0 #This works ok
EXPRESSION
MULTIPLE
ALL PROBLEMSIF TAG VALUES MATCH

tag for matching: service
tags:
name: service | value: {{ITEM.VALUE}.regsub("(?<=Service\s).*(?=\sis down+)","\1")} ##THIS DOE NOT WORK!!!

Is the regex incorrect? Why does it work on the name of the trigger?

Can someone please check this, I can't get the trigger events to work properly, and we don' t even know how to use them properly, what's the idea of having the chance of creating multiple tags when you only get to search for one?
Any help will be much appreciate!

Thanks in advance!

[karmukis]

Please anyone? any ideas? Does someone use this feature???
karina

[dimir]

How about this one:

{{ITEM.VALUE}.regsub("Service (.*) is down","\1")}

[karmukis]

Great!!
Well, it did work, that regex worked perfectly. Thank you so much Dimir!!!

But there is one more thing, doe maybe I should create a new POST for it... as I showed in my first POST, the output has the info for 3 sites, 2 of them are failing, so if I understood correctly, with one tag I should be able to match multiple errors, and so zabbix would create a tag according to the match, in this case it only creates the trigger for the first site the regex finds with issues.

If there is someone with more experience with this feature, I would appreciate more info of how to properly use it.

Thank you.
Karina

[dimir]

I think you need to provide recovery expression, the same way but with "200 OK" instead of "404". In order to specify recovery expression on the "OK event generation" line click "Recovery expression".

[karmukis]

I'm not sure is that. When you use event TAGS if I understood correctly, you can have 1 log, where 3 applicactions write their messages (logs) and you'll have multiple trigger created according the application with issues, that's why My regex is suppouse to be generic, so having multiple errors for different apps in the same log. But in my case that is not happening. The trigger creates an EVENT (1 alarm) only for the first app, the rest... is not even appearing.

Do you have more info about this feature? or a better example? To be honest zabbix doesn't have that much of info regarding this this

https://www.zabbix.com/documentation/3.2/manual/config/triggers/event_tags

Regards.
karina

[karmukis]

It's been a while but at the end with the help of ZABBIX support we got to the conclusion that my zabbix version 3.2.11 has a bug and that's why we couldn't get it to work...
So to al of you using that old version... this feaure doe not work in that version. This is the ZABBIX BUG TICKET: ZBX-14313 https://support.zabbix.com/browse/ZBX-14313
KAI