Issue with Notification Apply Rule filter

[Heilig]

Hi there,

I use Icinga to monitor network interfaces. Each network interface added as Icinga service and has 3-4 tags (custom service variable), e.g. “iftype=fabric”, “l2bend=switch1”, etc. I have a notification apply rule with ‘service.enable_notifications && service.check_command == “check_iftraffic64”’ assign rule. It works and Icinga sends notifications if there is an issue with an interface.

I would like to use interface tags as a filter. For example, send notifications if service.vars.tags has “fabric” string. I tried many different combinations:

• service.enable_notifications && service.check_command == “check_iftraffic64” && service.vars.tags in [ “iftype=fabric” ]
• service.enable_notifications && service.check_command == “check_iftraffic64” && match(“fabric”, service.vars.tags)
• service.enable_notifications && service.check_command == “check_iftraffic64” && “fabric” in service.vars.tags

It doesn’t work. Icinga doesn’t send notifications as soon as I add tags as a filter. How can I fix it and use tags as a filter?

[Heilig]

Any ideas on how to troubleshoot this issue are highly appreciated.

[yhabteab (Yonas Habteab)]

Hii,

When you have defined the tags custom var as a dictionary, try

service.enable_notifications && service.check_command == “check_iftraffic64” && service.vars.tags.iftype == "fabric" 

and when tags is an array, try

service.enable_notifications && service.check_command == “check_iftraffic64” && service.vars.tags[ "iftype"] == "fabric”

Regards,
Yonas

[Heilig]

Thank you for the comment. I use “array” custom var type. Several examples:

I tried ‘service.enable_notifications && service.check_command == “check_iftraffic64” && service.vars.tags[ “iftype”] == "fabric”’ notification rule filter and got many errors during the config deployment, e.g.:

• critical/config: Error: Invalid field access (for value of type ‘Array’): ‘iftype’
• critical/config: Error: Invalid field access (for value of type ‘String’): ‘iftype’

Any ideas how to fix them are highly appreciated.

[yhabteab (Yonas Habteab)]

Oh, I thought that iftype is supposed to be a key/ an index of the array. Have you also tried the following? service.enable_notifications && service.check_command == "check_iftraffic64" && "iftype=fabric" in service.vars.tags. It should actually work like this.

[Heilig]

I can’t use “iftype=fabric” in the filter at all. Icingaweb converts this:

to this as soon as I click “Store” button my “notification apply rule”:

Upgraded Icinga to the latest version (web 2.9.3 / php 7.3.29 / icinga 2.13.1). It is affected also.
Looks like there is a bug. Is there any way to escape the “=” charter?