You can now extract fields from the email alerts and map them to Freshservice. You can subsequently create more powerful alert rules for your email integrations.
Let's take an example to help you get started.
Scenario: Assigning "resource" from the email body to the Freshservice alert field
Let’s assume that you are sending the following email alert to Freshservice.
Sample email:
For instance, you want to get the resource field from the email body and assign it to Freshservice alert resource field. Let's break this down step by step.
Case 1: Working with a new email monitoring tool integration
1. Enable the map alert field toggle.
2. Paste a sample email alert that your monitoring tool will generate. You can choose to input either the text version of the email body or the HTML code of the email body. The version you choose will determine the source on which the system will apply regex. For our example, we chose the text version. Click on "Save & Continue" to move to the next page.
3. On the alert field mapping screen, click on "Resource" from the list of available fields. 
4. Select "email body (text)" as the email field.
5. Enter the following expression in the Regular expression field to extract the resource field from the given email body.
Resource:\s*(.*)
NOTE: Depending upon the expression entered, you will be able to see matchgroups under the values field. We allow upto 3 matchgroups.
In this example, the system will look for the keyword "Resource" and extract any values present after ":" and before the newline character (↲).
6. Choose matchgroup1 under the values dropdown to assign the matched value within the brackets of the regular expression.
In this example, it is as-w12-fat.
7. The system will apply the Regular Expression and the Match Group preference on the sample email and extract the first value that matches the expression. You will see the result under Content Preview.
8. Click on Save.
You have successfully extracted the Resource field from the email body and mapped it to the Resource field in Freshservice Alerts.
Similarly, to get Severity from the email subject.
1. Follow steps 1-8 and select Severity instead of Resource in Step 3.
2. Change the regular expression to Severity:\s*(.*) instead.
3. Additionally, modify the severity mapping to match the severity values you expect to be present in the email. In this example, you will add the keyword "High" mapped against the critical severity level. Therefore, whenever the email contains "Severity" as "High", the corresponding freshservice alert will have Critical Severity.
As a best practice try to create a regex for Severity that does not include leading or trailing spaces
4. Click on Save.
Case 2: Working with an existing email monitoring tool integration
To modify an existing alert field mapping configuration for an email monitoring tool integration that does not have a sample email template, you will first have to provide a sample email alert. This can be done as follows:
Click on add text sample or add an HTML sample depending upon the email body type of your alert. Add the sample alert and proceed to modify/add an alert field mapping by following the steps mentioned under Case 1.
You can use regular expressions to extract any part of your email (e.g., Email subject) to map it to one of the freshservice alert fields.
For instance,
To get the resource name from a subject like
Alert: CPU utilization is high on ec2-123-machine
Where the resource name is ec2-123-machine
You can use the expression
[\S]{3}-[\S]{3}-[\S]{7}
To get the node from an email body like
Device:eu-north [node: 179.42.241.136] Status:Not Responding Message:(Server not responding) Error code: 500
Where the node value is 179.42.241.136
You can use the expression
[\d]{1,}\.[\d]{1,}\.[\d]{1,}\.[\d]{1,}
You can use any online tool available for free to validate your regular expressions and get more information about them. Some of them are listed below:
For more assistance, contact support@freshservice.com
