Event field mapping configuration
Use Event field mappings rules to map values from specific fields to values in other fields.
Event Management stores event field mappings in the Event Field Mapping [em_mapping_rule] table. The mappings apply after event rule processing and prior to alert generation. The mapping values from the Event Mapping Pair [em_mapping_pair] table apply to the alert. The original event severity remains unchanged.
For example, if events come with the field "org_severity" with the values "Low, Medium, High" and you want the alert Severity to hold this value, create an event field mapping rule that maps the field org_severity to Severity, with these values:
| Original org_severity value | Map to alert Severity value |
|---|---|
| Low | Warning |
| Medium | Major |
| High | Critical |
Default event field mappings
Event Management provides default event field mappings for commonly used system monitoring tools. The Transform Value Pairs from event field mappings format the incoming event data for Event Management.
You can view the default event field mappings and mapping pairs by navigating to Event Management > Rules > Event Field Mappings and double-clicking Name.
For users familiar with the classic Event Management experience, enrich automations create event rules but with an easier interface and with better team support. For more information, see Create Enrich automation.
- Create event field mappings
Use event field mappings to map values from specific event fields to values in other fields to provide more comprehensive information in an alert. Use team-based integrations in event rules to make sure that connector ownership and execution of rules give precedence to global rules. Teams can maintain consistency and hierarchy while offering flexibility and customization options.
Parent Topic:Event Management