When 'CI filed matching' is used to bind an alert to a non-host CI (like application), compose is used to clear the Node field. But if you need to save the value in Node to a manual attribute to identify the CI (using compose section), then it is possible that a null value is copied to the manual attribute causing CI binding to fail. 

Steps to Reproduce

Pre requisite to demonstrate the issue:
1. Create a custom field on cmdb_ci_appl with name 'ci_id'
2. Create an application with ci_id as 'XYZ'

Steps to reproduce
1. Create an event rule for source ABC
2. Go to transform and compose section of event rule and use compose to clear ${node} from field Node
3. Use compose to add a manual attribute - ci_id
4. Go to Binding > Override default binding > select binding type as 'CI filed matching' and CI Type as 'Application'
5. Save event rule and set it to Active
6. Send an event with source ABC and node 'XYZ'
7. Notice that CI binding for the alert generated fails
8. The additional_info field of the alert has ci_id null/empty.


After carefully considering the severity and frequency of this problem, and risk of attempting a fix, it has been decided to not address this issue in any current or future releases. We do not make these decisions lightly, and we apologise for any inconvenience.

However, the requirement can still be achieved using the steps documented below.

  1. Use Event Match fields to copy value in Node to a new field (in this case ci_id)
  2. Use Event Compose fields to clear the value in Node field.

How this works?

When event rules are processed, Event Match fields always run first and then the Event Compose fields, therefore if you copy the value in Node to a new field (ci_id) using Match fields and then clear the value in Node field using compose fields, this should work!

The Event rules uses 2 different mechanisms -

  • Event Match fields- uses the regex option, basically the panel on the right of the screen. Select the node field there, highlight the value and map it to the new field (in this case ci_id).


  • Event Compose fields- uses the “table” in the left panel of the screen, basically concats values from other fields, or set consts (like empty) to those values.



Related Problem: PRB1391987

Seen In

SR - IRM - Audit Management - New York 2019 Q3
SR - IRM - GRC Profiles - Madrid 2019 Q2
SR - IRM - GRC Workbench - New York 2019 Q3
SR - IRM - PA Premium Integration - New York 2019 Q3
SR - IRM - Policy and Compliance - Madrid 2019 Q2
SR - IRM - Risk Management - New York 2019 Q3
SR - IRM - SIG Assessment Legacy - Madrid 2019 Q1
SR - IRM - SIG Questionnaire - New York 2019 Q3
SR - IRM - Vendor Risk Management - Madrid 2019 Q1
SR - ITOM - CMDB CI Class Models - 201908
SR - ITOM - Discovery and Service Mapping - 201908

Associated Community Threads

There is no data to report.

Article Information

Last Updated:2020-05-11 08:34:47
match&compose (1).png[View]regex (2).png[View]