Worfklow using expression references

[Marius_Hell]

Hi guys,

I have a challenge, which i don't solve, thats the reason for the post in hope, one of you can. 

I would like to automate an incident process in which, the name of the entity the key is, because of this information we will forward the tickets over our itsm-tool to the owners of the entity. We have a SaaS-Tenant from Dynatrace, so a "problem notification" is not possible because, the company does not allow Dynatrace to communicate. (Policy restrictions). Therefore we are using the Edge-Connect and workflow. 

I figured two options out, which makes more or less sens for me. The first one is in my opinion more bad than the second. The event information, as you see below, shows the id from the affectend-identity, which i grab and query the API from Dynatrace. Dynatrace sends the information about this entity back and i get, for example the hostname of this entity, which you see in the second snippit

Event information from workflow-object "Davis problem trigger":

{
  "event.id": "-967350873125529689_1727177580000V2",
  "timestamp": "2024-09-24T11:39:29.152000000Z",
  "display_id": "P-24094536",
  "event.kind": "DAVIS_PROBLEM",
  "event.name": "Low disk space",
  "entity_tags": [
    "CI:Server.domain",
    "Owner:xxxxx",
    "Service:xxxx",
    "Stage:xxxxxx"
  ],
  "event.start": "2024-09-24T11:38:00.000000000Z",
  "event.status": "ACTIVE",
  "event.category": "RESOURCE_CONTENTION",
  "dt.system.bucket": "default_davis_events",
  "event.description": "# Low disk space\n\nThe problem **affects 1 entity** overall.\n\nFollowing entities were affected by the problem:\n\n## Host, Server.domain\n\nResource: Low disk space\n\n- The total available space on disk C:\\ is lower than 99 %",
  "dt.davis.event_ids": [
    "-967350873125529689_1727177580000"
  ],
  "related_entity_ids": [
    "DISK-F8F372B82D741E8E"
  ],
  "affected_entity_ids": [
    "HOST-59C80367AAF10760"
  ],
  "dt.davis.mute.status": "NOT_MUTED",
  "affected_entity_types": [
    "dt.entity.host"
  ],
  "dt.davis.is_duplicate": false,
  "event.status_transition": "CREATED",
  "dt.davis.is_frequent_event": false,
  "maintenance.is_under_maintenance": false
}

Api information from entity (a short snippit) ObjectName in workflow (dynatrace_get-host-entity):

"standalone": false,
    "memoryTotal": 8589398016,
    "networkZone": "default",
    "detectedName": "Server.domain",
    "macAddresses": [
      "00:50:56:95:25:4F"

The important information is in "detectedName" which i can use to forward this information to the owner. The Main problem for me is, it could be more than one entity affected by the problem. In this case my whole automation isn't working well because i don't know if the entity is the root cause and the automation will fail or send wong infromations to the owner. 

The seconde idea is to tag all entitys in Dynatrace with the name of CI, which you can see here: (The informations are from the worflow object "Davis problem trigger" which I already posted in the first snippit.

 "entity_tags": [
    "CI:Server.domain",
    "Owner:xxxxx",
    "Service:xxxx",
    "Stage:xxxxxx"
  ]

Unfortunately here is the problem, that i can't filter or extract the information from the tag CI. I tried everything what makes sense for me. I also tried to use the doucmention from jinja (Jinja documentation) without any success.

Long introduction for two questions:

1. Had anyone the same challenge and solved it, mabe in a better way? My feeling about is, that my solution is to complicated.

2. Is it possible to extract the CI information from the field entity_tag

If you had any questions, feel free to ask.

Thank your for any help! 

[christian_kreuz]

Option 1: If you want to do this with a Jinja Template, you can do that with the following Snippet:

{% for tag in event()["entity_tags"] %}
	{% if tag | regex_search("CI:") %}
	Found the following CI as tag: {{ tag }}
    {% endif %}
{% endfor %}

Option 2: If you already have a "Run JavaScript" action within your Workflow, my suggestion would be to extend it with the following code snippet:

export default async function ({ executionId }) {
  // response from API, containing entity_tags
  const obj = {
     "entity_tags": [
        "CI:Server.domain",
        "Owner:xxxxx",
        "Service:xxxx",
        "Stage:xxxxxx"
      ]
  };

  // filter: only get tags starting with "CI:"
  const entityTagsWithCI = obj.entity_tags.filter((entityTag) => {
    return (entityTag.indexOf("CI:") == 0);
  });

  // optional: Remove the string "CI:" in front
  return entityTagsWithCI.map((entityTag) => {
    return entityTag.replace("CI:", "");
  });
}

Option 3: Tweak your Davis problem trigger by adding a filter with

isNotNull(root_cause_entity_id)

which should also give you access to the name directly via the attribute

root_cause_entity_name