Remove certain tag automatically
Asked by Jacky Chen:

Hello,

I'm having trouble to manage tags for the alert. Let's say the Googlestackdriver integration creates an alert with the following tags:

* "location:us-east1-a" (with "location:{{_payload.incident.resource.labels.zone}}")
* "location:" (with "location:{{_payload.incident.resource.labels.region}}" while _payload.incident.resource.labels.region doesn't exist)
* some other tags that is not started with "location:"

Alert filter doesn't appear to capable accepting any field within _payload, so I can't split create action into two.

Using the tag "location:{{_payload.incident.resource.labels.region}}{{_payload.incident.resource.labels.zone}}" is not feasible as I'm not able to guarantee both fields will not appear at the same time, unless I can use some sort of conditional expression within the dynamic field.

The worst case scenario is that I have to create an webhook integration and an API integration, so I can review and modify the alert automatically with external program.

As this method will increase the complexity of how a new alert is handled, I want to avoid that if possible.

Is Opsgenie able to remove tag with matching criteria from alert automatically with alert policy or something else natively on Opsgenie?


Answers:
author: John M
body: Hi [@Jacky Chen](/t5/user/viewprofilepage/user-id/5289177) ,

Without knowing your exact requirements, you might be able to extract only the tags you need and 'remove' unwanted tags using either string processing, regex, or a combination of both:

<https://support.atlassian.com/opsgenie/docs/string-processing-methods-in-opsgenie-integrations/>

<https://support.atlassian.com/opsgenie/docs/regular-expressions-for-improved-alert-filtering/>

comments: author: Jacky Chen
body: OK, I've made some progress.

What I'm trying to achieve is to remove any tags with colon symbol at the end and, if possible, preserve capitals for the tags.

I use {{tags}} in the alert description and it gives me something like:

```
[location:us-east1-a, location:, instance_name:my-vm-instance, project_id:my-gcp-project, system:test]
```

I can sort of treat {{tags}} like a string in alert policy. I didn't find method to do string replace, with or without regex. This is what I came up with in the tags in the alert policy:

* location:{{tags.extract(/location:(\[\^,\\\]\]+)/)}}
* instance_name:{{tags.extract(/instance_name:(\[\^,\\\]\]+)/)}}
* project_id:{{tags.extract(/project_id:(\[\^,\\\]\]+)/)}}
* system:{{tags.extract(/system:(\[\^,\\\]\]+)/)}}

Although not elegant, it kind of works with one strange caveat: all characters has been converted to lowercase. There was a tag "system:Test" and it's now "system:test".

Is there anything I can achieve so I can remove tags ends with a colon symbol and preserve character case?


author: John M
body: Since your regex uses '+' it should only match tags that have at least one character after the semicolon - so 'location:' should not show up. When I tested this only the tag with a value after the semicolon was added to the description:

![2023-08-11_15-44-13.png](https://community.atlassian.com/t5/image/serverpage/image-id/274771i2B2FA9C1FC626F18/image-size/large?v=v2&px=999 "2023-08-11_15-44-13.png")![2023-08-11_15-43-32.png](https://community.atlassian.com/t5/image/serverpage/image-id/274772i599ABBF4B46ADAB0/image-size/large?v=v2&px=999 "2023-08-11_15-43-32.png")

As for the case, I don't believe there is any workaround for that; I believe the system just translates all processed characters to lower case


Tags: cloud