DocsICP FilingConsole
Documentation
Home Page Cloud Monitor Cloud Monitor 2.0 Alert Center Event Management Event handling

Event handling

Updated at:
Copy as MD
Product
My Favorites

Event processing in CloudMonitor Event Center transforms incoming events by modifying fields, extracting data, and merging tags.

Overview

After events are integrated, event processing transforms and structures event data:

  • Assign values to, clear, or extract data from event fields.

  • Extract information from raw data using regular expressions or JSON parsing.

  • Configure a scope to process only matching events.

  • Set the execution order to control the priority of multiple processing flows.

  • Exit after a match to avoid duplicate processing.

Create an event processing flow

  1. Log on to the CloudMonitor console, select the target workspace, and in the left-side navigation pane, choose All Features > Event Center.

  2. In the navigation pane of Event Center, choose Event Management > Event Handling.

  3. On the Event Handling page, click Create Processing Flow.

  4. In the Create an event processing stream dialog box, configure the following parameters.

    1. Name: Enter a custom name for the event processing flow.

    2. Description: Enter a description for the event processing flow.

    3. Exit after matching is completed: Specifies whether to stop processing subsequent flows after this one matches an event. You can select Yes or No.

      • Set to Yes: After an event matches this processing flow, subsequent processing flows will not be executed.

      • If set to No, the event continues to execute the subsequent processing flows sequentially.

    4. Effective Scope: Defines the conditions an event must meet to be processed by this flow.

      • Condition logic

        • Any: The event must match at least one of the conditions.

        • All: The event must match all of the specified conditions.

        • Composite: The event must match a custom combination of conditions. You can select the condition numbers to create the combination.

      • Condition N: You can add multiple conditions.

        Parameter

        Description

        Event source type

        Select the event field to use for the condition.

        • Severity

        • Alert status

        • Alert Name

        Select built-in resource tags.

        • Cloud Product:_cms_acs_product

        • System Event Resource Name:_cms_acs_sys_event_arn

        • System Event Level:_cms_acs_sys_event_level

        • System Event Name:_cms_acs_sys_event_name

        • System Event Status:_cms_acs_sys_event_status

        • System Event Type:_cms_acs_sys_event_type

        • _cms_app_name

        • _cms_domain

        • _cms_entity_type

        • _cms_instance_name

        • Event Integration ID:_cms_integration_id

        • _cms_log_audit_rule_template_id

        • _cms_log_audit_rule_type

        • regionId:_cms_region

        • _cms_rule_id

        • Log Service Logstore:_cms_sls_logstores

        • Log Service Project:_cms_sls_project

        • Workspace:_cms_workspace

        Custom tag

        Select custom tags that you have defined.

    5. Processing logic: You can add multiple processing logic steps. Click Add Processing Logic. In the Processing logic dialog box that appears on the right, configure the following parameters.

      Logic type

      Description

      Assign attribute

      Sets the value of an event field based on a specified value or a source path.

      • Source: The source for the attribute assignment.

        • Source path: The path to the source data. The prefixes data., event., and variables. are supported.

          Source path description

          • Path prefixes

            • data.: Accesses the raw data field of the event. Examples: data.alert.severity and data.detail.AlarmName.

            • event.: Accesses the event's own fields. Examples: event.severity and event.labels.xxx.

            • variables.: Accesses variables created by a previous extraction. Examples: variables.var1[0] and variables.var1.field.

        • Set Value: You can enter a static string or use a template format. For example, Severity: ${event.severity}, Subject: ${event.subject}

      • Target: Select a target attribute.

        Optional attributes

        • ID

        • SOURCE

        • TIME (timestamp; a time string is automatically converted to a timestamp in milliseconds. If the conversion fails, the current time is used.)

        • TIMESTAMP

        • Event description (SUBJECT)

        • Severity (SEVERITY)

        • Alert status: OCCURRED, PERSISTENT, or RECOVERED (STATUS)

        • Event labels (LABELS)

        • DATA

        • RESOURCE_ID

        • RESOURCE_TYPE

        • RESOURCE_URI

        • RESOURCE_TAGS

        • RESOURCE_NAME

      Clear attribute

      Clears the value of a specified field and resets it to the default value.

      • Target attribute: Select a target attribute to clear.

        Optional attributes

        • ID: Generates a new universally unique identifier (UUID).

        • SOURCE: Becomes an empty string.

        • TIME: Resets the timestamp to the current time.

        • STATUS: Resets to OCCURRED by default.

        • Event description (SUBJECT): Becomes an empty string.

        • Severity (SEVERITY): Resets to INFO by default.

        • LABELS: Clears all event labels.

        • ANNOTATIONS: Clears all annotations.

        • RESOURCE_TAGS: Clears all resource tags.

        • RESOURCE_ENTITY: Clears all resource attributes.

      Merge labels

      Retrieves a map from the source path and merges its key-value pairs into the event labels.

      • Source: Specify the path to the data that contains the map, for example, data.tags.

      • Target attribute: Select a target attribute.

        Optional attributes

        • ID

        • SOURCE

        • TIME (timestamp; a time string is automatically converted to a timestamp in milliseconds. If the conversion fails, the current time is used.)

        • TIMESTAMP

        • Event description (SUBJECT)

        • Severity (SEVERITY)

        • Alert status: OCCURRED, PERSISTENT, or RECOVERED (STATUS)

        • Event labels (LABELS)

        • DATA

        • RESOURCE_ID

        • RESOURCE_TYPE

        • RESOURCE_URI

        • RESOURCE_TAGS

        • RESOURCE_NAME

        Merge rules

        • The system only merges key-value pairs where the key is a string and the value is a string, integer, or long.

        • The system filters out null values and other data types.

        • The system converts all merged values to strings.

      Text extraction

      Extracts one or more fields from a source data string by using a regular expression. The extracted data is saved as an array in a variable such as var1, which can be referenced in subsequent processing nodes. For example, variables.var1[0] references the first captured group and variables.var1[1] references the second.

      • Source: Specify the path to the data you want to extract from, for example, data.message.

      • Regular Exp: Write a regular expression that uses capture groups to extract multiple fields.

      • Extract to variable: Specify a name for the variable that will store the extracted results.

      Usage example

      Regular expression: ([^:]+):([^:]+):([^:]+)

      Source data: error:database:connection_timeout

      Extraction result:

      • variables.var1[0] = error

      • variables.var1[1] = database

      • variables.var1[2] = connection_timeout

      You can reference extracted variables in the source path of subsequent processing logic steps.

      JSON extraction

      Parses a JSON string from a specified data node into a map and assigns it to a variable such as var1. You can then reference fields in subsequent processing nodes, for example, variables.var1.field1.

      • Source: Specify the path to the data that contains the JSON string, for example, data.json_content.

      • Extract to variable: Specify a name for the variable that will store the parsing result.

      Usage example

      Source data (JSON string):

      {"alertName": "High CPU", "instanceId": "i-xxxxx", "region": "cn-hangzhou"}

      Parsing result:

      • variables.var1.alertName = High CPU

      • variables.var1.instanceId = i-xxxxx

      • variables.var1.region = cn-hangzhou

  5. If you have configured multiple processing logic steps, you can adjust their execution order:

    • Click Move Up to move the current step one position up.

    • Click Move Down to move the current step one position down.

    The system executes the steps sequentially from top to bottom. Variables extracted in one step can be used in subsequent steps.

  6. After you configure the parameters, click OK.

Manage event processing

After you create an event processing flow, manage it from the list:

  • Adjust the flow order: In the Execution order column for the target flow, set a number to change its order.

    • Event processing flows execute in ascending order of the Execution Order (sortId) value:

      • A smaller value indicates a higher priority and earlier execution.

      • You can directly modify the execution order on the list page.

      • Multiple flows can process the same event sequentially.

  • Enable or disable an event processing flow: In the Status column for the target flow, click the toggle.

  • Update an event processing flow: In the Actions column for the target flow, click Edit.

  • Delete an event processing flow: In the Actions column for the target flow, click Delete and then Confirm.

    Warning

    Once an event processing flow is deleted, its configuration cannot be restored.

Event processing workflow

Events flow through the following stages:

raw event → event integration → event processing (transformation) → event subscription (filtering) → event grouping → alert notification

Relationship between event processing and event subscription

  • event processing: Transforms a raw event by modifying its fields and content.

  • event subscription: Determines which users receive notifications based on the processed event content.

Event processing is independent of event subscription. Events can be preprocessed before they enter the subscription workflow.

Configuration examples

Example 1: Extract an alert name

Set the event's SUBJECT to the value of the alert.name field from the raw data:

Parameter

Value

Logic Type

Assign Property

Source Path

data.alert.name

Target Property

SUBJECT

Example 2: Set a fixed severity level

Set the event's severity level to WARNING:

Parameter

Value

Logic Type

Assign Property

Set Value

WARNING

Target Property

SEVERITY

Example 3: Map status values

Map status values from a third-party system to standard system statuses:

Parameter

Value

Logic Type

Assign Property

Source Path

data.status

Target Property

STATUS

mapping table

firing → OCCURRED, resolved → RECOVERED

Example 4: Extract and add a label

Extract the instanceId from the raw data and add it as an event label:

Parameter

Value

Logic Type

Assign Property

Source Path

data.detail.instanceId

Target Property

LABELS

label key

instanceId

Example 5: Extract fields with a regular expression

Extract the service name and error type from a message:

Parameter

Value

Logic Type

text extraction

Source Path

data.message

regular expression

Service:(\w+),Error:(\w+)

Extract Variable

extracted

Then, use the extracted variable in a subsequent operation:

Parameter

Value

Logic Type

Assign Property

Source Path

variables.extracted[0]

Target Property

LABELS

label key

serviceName

Standard event data structure

The standard event format (CmsEvent) in CloudMonitor contains the following fields:

Parameter

Type

Description

id

String

A unique identifier for the event.

dedupId

String

The deduplication ID used to prevent duplicate events from being processed.

type

String

The event type. Valid values: ALERT, CHANGE.

subtype

String

The event subtype. Examples: NORMAL_TRIGGER, ABNORMAL_TRIGGER_DATA_INSUFFICIENT.

source

String

The source of the event.

timestamp

Long

The event timestamp in milliseconds.

time

String

The formatted event time.

subject

String

The subject or title of the event.

severity

String

The severity level. Valid values: CRITICAL, WARNING, INFO.

status

String

The event status. Valid values: OCCURRED, PERSISTENT, ACK, CLOSED, RECOVERED.

labels

Map

The event labels.

annotations

Map

The event annotations.

data

Object

The raw event data.

resource

Object

The resource associated with the event.

userId

String

The owner of the event.

workspace

String

The workspace to which the event belongs.

Resource information structure

Parameter

Description

resource.tags

The resource's key-value tags.

resource.entity.domain

The domain to which the resource belongs, such as acs.

resource.entity.entity_type

The resource type, such as acs.ecs.instance.

resource.entity.entity_id

The resource ID.

resource.entity.prop

The resource properties as key-value pairs.
Previous：Event integrationNext：Best practices