Alert-CI binding: When CI filed matching is used, the order in which Compose fields are evaluated can cause CI binding to fail - Known Error

Alert-CI binding: When CI filed matching is used, the order in which Compose fields are evaluated can cause CI binding to fail Description When 'CI filed matching' is used to bind an alert to a non-host CI (like application), compose is used to clear the Node field. But if you need to save the value in Node to a manual attribute to identify the CI (using compose section), then it is possible that a null value is copied to the manual attribute causing CI binding to fail.

Steps to Reproduce

Pre requisite to demonstrate the issue: 1. Create a custom field on cmdb_ci_appl with name 'ci_id' 2. Create an application with ci_id as 'XYZ'

Steps to reproduce 1. Create an event rule for source ABC 2. Go to transform and compose section of event rule and use compose to clear ${node} from field Node 3. Use compose to add a manual attribute - ci_id 4. Go to Binding > Override default binding > select binding type as 'CI filed matching' and CI Type as 'Application' 5. Save event rule and set it to Active 6. Send an event with source ABC and node 'XYZ' 7. Notice that CI binding for the alert generated fails 8. The additional_info field of the alert has ci_id null/empty.

Workaround After carefully considering the severity and frequency of this problem, and risk of attempting a fix, it has been decided to not address this issue in any current or future releases. We do not make these decisions lightly, and we apologise for any inconvenience.

However, the requirement can still be achieved using the steps documented below.

Use Event Match fields to copy value in Node to a new field (in this case ci_id) Use Event Compose fields to clear the value in Node field. How this works?

When event rules are processed, Event Match fields always run first and then the Event Compose fields, therefore if you copy the value in Node to a new field (ci_id) using Match fields and then clear the value in Node field using compose fields, this should work!

The Event rules uses 2 different mechanisms -

Event Match fields- uses the regex option, basically the panel on the right of the screen. Select the node field there, highlight the value and map it to the new field (in this case ci_id).

Event Compose fields- uses the “table” in the left panel of the screen, basically concats values from other fields, or set consts (like empty) to those values.