Creating custom event sources with JSON
You can insert event information into Netcool® Operations Insight® from any event source that can send the information in JSON format.
About this task
Using a webhook URL, set your event source to send event information to Netcool Operations Insight. Using an example incoming request in JSON format, define the mapping between the event attributes from your source and the event attributes in Netcool Operations Insight.
Procedure
Mapping JSON attributes to normalized attributes
Ensure you are familiar with the JSON format, see https://www.json.org/.
For more complex mappings, use JSONATA functions, see http://docs.jsonata.org/object-functions.html.
Normalized attribute | Mapped to Netcool/OMNIbus alerts.status field |
---|---|
incidentUuid |
IncidentUuid |
correlationKey |
IncidentKey |
instanceUuid |
InstanceUuid |
deduplicationKey |
Identifier |
firstOccurrence |
FirstOccurrence |
lastOccurrence |
LastOccurrence |
summary |
Summary |
resource.node |
Node |
resource.hostname |
Node |
resource.NodeAlias |
NodeAlias |
sender.service |
Agent |
sender.name |
Manager |
resource.location |
Location |
resource.service |
Service |
resource.port |
PhysicalPort |
resource.physicalslot |
PhysicalSlot |
resource.physicalcard |
PhysicalCard |
resource.sourceId |
BSM_Identity |
type.eventType |
AlertGroup |
severity |
Severity |
The following example demonstrates the mapping of mandatory event attributes from a JSON request to Netcool Operations Insight:
Attribute in example incoming request | Normalized event attribute | Mapping value | Result in event information |
---|---|---|---|
|
Severity |
|
Major |
Summary |
Tip: Back ticks (``) are required in the mapping to interpret attributes with the at
sign (@) in the incoming request.
|
High CPU usage in New York |
|
Resource name |
|
Server A |
|
Event type |
|
Utilization |
The following example demonstrates the mapping of the optional Details and Timestamp event attributes from a JSON request to Netcool Operations Insight:
Attribute in example incoming request | Normalized event attribute | Mapping value | Result in event information |
---|---|---|---|
|
Details |
|
96 |
Timestamp |
Important: The value can be an integer set in milliseconds since the Unix Epoch (January
1970), or a ISO-8601 format string such as 1991-09-06 14:56:20.
Note: If your event does not contain time information, you can use
$now() to set a
time stamp. |
2018-02-28T16:35:22.797Z |
Some optional attributes can have more than one instance, and the number of instances can vary from one event to another. For example, you can add more than one instance of the URL field, and provide a mapping expression for each of them. If your mapping expression produces an array of values (for example, selecting fields from within a list in the incoming request), the corresponding number of instances of the event attribute will automatically be created.
The following example demonstrates the mapping of the optional URL event attribute from a JSON request to Netcool Operations Insight:
Attribute in example incoming request | Normalized event attribute | Mapping value | Result in event information |
---|---|---|---|
|
|
|
URLs http://abcmonitoring.com Launch to ABC Monitoring |
|
|
URLs http://xyzmonitoring.com Launch to XYZ Monitoring |
The following example is also for an array, but using the optional Details attribute, and shows how to change the mapping from the first list within the array to the second list within the array.
Attribute in example incoming request | Normalized event attribute | Mapping value | Result in event information |
---|---|---|---|
|
Details |
|
|
Details |
|
|
24-JUN-2020 Post 1.6.1 conref work (related links below)