Event Orchestration Variables
The Event Orchestration Variables (cache variables) feature lets users save event information once events become alerts or incidents. This saved information can be used in Event Orchestration rules for conditions or actions. Variables can be set in both Global and Service Orchestrations, however they cannot be used outside of the orchestration where they were created. Using variables in Event Orchestration rules enables users to handle various new situations where understanding a system's status, event patterns, or timing is crucial for identifying the issue at hand.
There are two ways to store data in variables. Both variable types are populated whenever an event matches the conditions assigned to a cache variable:
- Recent event values: Assign data from an event to a variable.
- Count of events: Number of occurrences of events matching the variable’s condition.
Tip
Configuring cache variable conditions works identically to setting Event Orchestration rule conditions.
Configure Event Orchestration Variables
Step 1: View Cache Variables
You can access Event Orchestration caches variables from either the Global Event Orchestration or Service Event Orchestration builder.
To view cache variables:
- In the web app, navigate to AIOps Event Orchestration and select your desired Global Orchestration or Service Orchestration.
- Click View Cache Variables in the bottom-left. This will expand the Cache Variables pane.
- Any existing variables will be displayed in this view. If no variables exist yet, you will be able to review some information about creating your first variable.
![Event Orchestration Cache Variables](https://files.readme.io/691f8ec-cache_variables.png)
Event Orchestration Cache Variables
Step 2: Create a New Cache Variable
To create a new variable:
- Click + Variable to open the variable creator modal.
- Define the conditions that will determine when a variable is populated with data, and click Next.
- Note: Creating conditions for cache variables follows that same process as creating rules for Event Orchestration.
- Enter a Variable Name and select a Variable Type from the dropdown: Event Data (CEF), Raw Data, or Event Count.
- The Variable Name is the display name that will appear in Event Orchestration rules and actions.
- The Variable Type defines what data is populated into a variable. There are three options for variable type and only one can be selected at a time for each variable. The three options are:
- Event Data (CEF): Stores CEF data associated with an event in the variable. Note: If an event’s data has been altered by Event Orchestration prior to variable population, the altered data will be stored in the variable.
- Raw Data: Allows users to target information in an event’s raw payload for storage.
- Event Count: Tracks the number of times an event matching the specified variable conditions has occurred.
- When you are finished, click Save.
Step 3: Using Your Variable
Variables can be used in either Event Orchestration rule conditions or actions.
Variable Duration
Stored values last for 24 hours or until they're replaced by a new value. When a new value is set, the 24-hour countdown starts again.
Use a Variable in a Condition
- Click + New Rule or click to edit an existing rule in an Event Orchestration that contains variables.
- Select If events match certain conditions from the condition type dropdown.
- Assign the variable to either the target (e.g.,
event.summary
) or value (i.e., the value being compared to whatever data is stored in the target) portion of the condition.- To assign a variable to the target portion of an Event Orchestration condition, click the cell that shows event and scroll to the bottom of the resulting dropdown. Next, select Cache Variable. This will populate the cell with
cache_var
, which is how Event Orchestration references variables. Then type the variable name you wish to use after the period in the cell (e.g.,cache_var.server_status
). - To assign a variable to the value portion of an Event Orchestration condition, click the cell that is blank in the condition builder. Type the name of the Variable you want to reference using the following syntax:
cache_var.your_variable_name
.
- To assign a variable to the target portion of an Event Orchestration condition, click the cell that shows event and scroll to the bottom of the resulting dropdown. Next, select Cache Variable. This will populate the cell with
![Event Orchestration target](https://files.readme.io/fb1e7f7-target.png)
Event Orchestration target
![Event Orchestration value](https://files.readme.io/d4be255-value.png)
Event Orchestration value
Tip
Using a variable in the target portion of a condition means a rule will evaluate
true
orfalse
without referencing the data in an event when an event is ingested. This allows you to create a logic gate that activates different branches of an Event Orchestration depending on what data is in a variable (e.g.,maintenance_window
,server_status
,deployment_status
, etc.).
Use a Variable in an Action
- Navigate to the action you wish to reference the variable in. Supported actions are:
- Add incident note
- Replace event fields
- Webhooks
- Add the variable to the action using the following syntax:
{{cache_var.your_variable_name}}
. - Click Save.
Edit Event Orchestration Variables
- In the web app, navigate to AIOps Event Orchestration and select your desired Global Orchestration or Service Orchestration.
- Click View Cache Variables in the bottom-left to expand the Cache Variables pane.
- To the right of your desired cache variables, select Edit configuration.
- Make your desired changes to the variable's condition and click Next.
- Make your desired changes to the variable's properties and click Save.
Disable or Delete Event Orchestration Variables
Disabled and Deleted Cache Variables
Please be advised that disabling or deleting a cache variable may lead to unexpected behavior if there any rules that still reference it. When a cache variable is disabled or deleted, it evaluates as
NULL
. For example, say you create a cache variablehost
and use it in a rulecache_var.host matches event.host
. After disabling or deletinghost
, the rule would evaluate toNULL matches event.host
.As a best practice, please update your Event Orchestration rules before disabling or deleting a cache variable.
Disable an Event Orchestration Variable
- In the web app, navigate to AIOps Event Orchestration and select your desired Global Orchestration or Service Orchestration.
- Click View Cache Variables in the bottom-left to expand the Cache Variables pane.
- To the right of your desired cache variable, select Disable.
- In the confirmation modal, click Disable.
To re-enable a cache variable, select Enable.
Delete an Event Orchestration Variable
- In the web app, navigate to AIOps Event Orchestration and select your desired Global Orchestration or Service Orchestration.
- Click View Cache Variables in the bottom-left to expand the Cache Variables pane.
- To the right of your desired cache variable, select Delete.
- In the confirmation modal, click Delete.
Note: This action cannot be undone, and deleted cache variables cannot be recovered.
Product Limits
Variables per Orchestration
- Each Global Orchestration can have 100 Variables.
- Each Service Event Orchestration can have 100 Variables.
- Variables are not supported for Service Routes.
Variable Content
- Variables can store a maximum of 1024 characters.
- Variable data is stored as string data unless the variables type is set to event count, in which case the data is stored as an integer.
Variables Accuracy
During our Early Access program, cache variables will be accurate to the second level (i.e., if multiple events try to populate a variable in less than 1 second, we can not guarantee which order the variable will be populated in). This limit will be re-assessed based on Early Access feedback to determine if it needs to be adjusted.
FAQ
Can you use a cache variable created in a Global Orchestration as part of a Service Orchestration?
No, cache variables can only be referenced in the Event Orchestration they were created for. If you'd like to pass data from a Global Orchestration to a Service Orchestration, for example, consider using a custom_details
Event Field. Please read Event Fields for more information.
Can you view historical values for a variable?
Viewing historical variables is not currently supported. We plan to support the ability to view a variable’s current value when the feature is released for General Availability.
What happens if a variable value exceeds 1024 characters?
Variable data will be truncated to fit the 1024 character limit.
Can non-string types be converted to strings?
Cache variables uses PagerDuty Condition Language (PCL), identical to Event Orchestration rules, and will attempt to interpret data in its correct format. If that process fails, it will interpret data as a string.
What is the maximum value an Event Count variable can be?
There is no maximum value for an event count variable. The maximum time range for an event count variable is 24 hours.
What happens if two variables in the same Event Orchestration have the same name?
It is not possible to create two variables with the same name in the same Event Orchestration. If a user attempts to do this, they will be presented with an error message.
How can I tell what the current value of a variable is?
When this features enters General Availability, there will be functionality added to display current variable value in the variables drawer portion of the Event Orchestration UI. This functionality is not available in the Early Access release of the feature. However, users can leverage the variables API to get the current value of a variable.
Is Event Orchestration variables API supported?
Yes, there is API support for variables. In addition, we will be supporting variables with Terraform when the feature enters General Availability.
Updated 17 days ago