Using custom fields

Define custom columns in alert properties according to your business requirements.

Generally, alerts in Cloud Pak for AIOps contain a set of predefined attributes that cover the general use cases. However, in some cases, you might want to add custom attributes to the alerts, which are specific to your process. For example, a retail store might want to keep track of a store ID, or a communication service provider might want to track the location of a cell tower. These custom fields can be used for mapping incoming data, determining which policies to execute, or as part of automation actions. You can view custom fields alongside the predefined fields in Alert Viewer.

To define those custom columns, you can use the custom field in the event/alert source configuration JSONata.

Previously, the details field was used to define the custom field data. Starting from Cloud Pak for AIOps version 4.11.1, you must use the new custom field, which is highly storage-efficient, to store custom field data. Also, when you use the new custom field, make sure that you modify any views, filters, permissions, or tooling that were previously set up to refer to the details attributes. The details field is retained in the product for backward compatibility, but it is not suggested to be used in production environments anymore.

You can use custom fields in integrations that allow JSONata mapping. These integrations include IBM Netcool Operations Insight ObjectServer and Webhook.

If you want to use custom fields when you map incoming data (within an integration), then you need to define a custom field mapping in the JSONata. Add key and value pairs for your custom fields within the custom object.

See the following example of an integration JSONata where custom columns are added to the event schema:
"custom": {
        "alertGroup": alert.@AlertGroup = "" ? undefined : alert.@AlertGroup,
        "alertKey": alert.@AlertKey = "" ? undefined : alert.@AlertKey,
        "customer": alert.@Customer = "" ? undefined : alert.@Customer,
        "appId": alert.@AppID = "" ? undefined : alert.@AppID,
        "region": alert.@Region = "" ? undefined : alert.@Region,
        "ttNumber": alert.@TTNumber = "" ? undefined : alert.@TTNumber,
        "location": alert.@Location = "" ? undefined : alert.@Location,
        "itnmCorrelation": alert.@NmosCauseType = 1 ? $string(alert.@Serial) : alert.@NmosCauseType = 2 ? alert.@NmosSerial : undefined,
        "servername": alert.@LocalNodeAlias = "" ? undefined : alert.@LocalNodeAlias,
        "portnumber": alert.@LocalPriObj = "" ? undefined : alert.@LocalPriObj,
        "url": alert.@URL = "" ? undefined : alert.@URL
    },

For more information about displaying custom fields in Alert Viewer, see the Columns from custom properties section in Creating views.

For more information about usage of custom fields when you create or customize a policy, see Policy editor.