AdvisorIngestion of Alerts via Email
There have been a few different variations of EventSources for ingesting alerts via email over the years. I recently had need for some additional functionality, such as dynamic property replacement in the subject line, so created a new variation that I'm sharing here in case it's useful to others.
At its most basic, the EventSource checks an IMAP inbox for unseen messages that have specific text in the subject line. If a match is found, it captures the body of the email in a new alert associated to the host/resource in LogicMonitor where the properties are defined. By default, processed emails are marked as read but can optionally be flagged for deletion.
Because the EventSource supports dynamic replacement of a property value in the subject line, it allows the potential of having the module associate to multiple LogicMonitor resources and alert based on matching hostnames in incoming email subjects. For example, if you have the 'email.subject' property set to "Email Alert on ##system.hostname##" and an email is received with the subject line "Email Alert on host1", it would appear as an alert on the 'host1' resource in LogicMonitor.
LM Exchange locator code: AHDXND
Required properties:
- imap.host: The address of the IMAP server.
- email.user: Username the module will to login & check for new emails.
- email.pass: Password for the email user.
Optional properties:
- email.subject: The email subject to search for. This can include a property name (example: "##system.hostname##") for dynamic replacement. Default: "Email Alert".
- imap.type: IMAP security type (SSL or TLS).
- email.deleteProcessed: Whether to attempt to delete processed email (versus just marking them as read). Default: false. NOTE: auto-deleting processed email may not work on Gmail due to Google's non-standard handling of IMAP.
- email.folder: Inbox sub-folder to monitor (example: "Inbox/Errors"). Default: "Inbox".
Below is an example email regarding a specific host...
This is how the resulting alert displays on that host in LogicMonitor...
