RestAPI Alerts access to ExternalTicketID

Has anyone figured out how to get at the ##ExternalTicketID## programatically at all? Not having access to that is driving me to distraction. It's in the DB somewhere, but we can't get to it to help automate our workflows and toolsets.

Right now, I'm troubleshooting our Connectwise Integration and have to manually relate 4637 integration log entries to tickets manually one by one.

Only having this internal var being able to be exposed in the Alerts view is hobbling our ability to build and troubleshoot our integrated systems.

Cole McDonald

Posted 1 year ago·Last reply 1 year ago

20 comments

Cole McDonald

OP1 year ago

That worked! Thank you.

Cole McDonald

OP1 year ago

I am passing the x-version=3... let me comment that out and see if it grabs that data for me.

That returns nothing. Are you passing a different value for the version?

Dave Lee

·1 year ago

I'm using X-Version=3 as well. Looks like you're using PowerShell, here's a snippet that's working for me.

$company = "your-lm-company"  # Replace with your LogicMonitor company name
$bearerToken = "your-lm-bearer-token" # replace with your LM bearer token
$daysAgo = 2  # Number of days to look back for alerts

# calculates the epoch time for the start of the query
$startEpoch = (Get-Date (Get-Date).AddDays(-$daysAgo) -UFormat %s) 

# query string includes the ##EXTERNALTICKETID# custom column and filters for alerts created after the startEpoch.  
# This Will get the first 1000 results, you'll need to put a loop in to handle paging if you expect  more than that.
$queryString = ('?customColumns=%23%23EXTERNALTICKETID%23%23&size=1000&offset=0&filter=startEpoch>:' + $startEpoch)

$headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]"
$headers.Add("Authorization","Bearer $bearerToken")
$headers.Add("X-Version",'3')
$headers.Add("Content-Type",'application/json')

$alerts = (Invoke-RestMethod -Uri "https://$company.logicmonitor.com/santaba/rest/alert/alerts$queryString" -Method "GET" -Headers $headers).items

# Filter the alerts to only include those that went to a rule where the name includes "Service Now" and that were not suppressed (e.g. not SDT at the time)
# Does a bit of manipulation to extract the ServiceNow Incident ID from the custom column ##EXTERNALTICKETID##
$alerts | where-object {$_.rule -like "*Service Now*" -And !($_.suppressor)} | Select-Object `
    @{Name="Alert ID";Expression={$_.id}}, `
    @{Name="InternalId";Expression={$_.InternalId}}, `
    @{Name="External_Ticket_ID_RAW";Expression={$_.customColumns.'##EXTERNALTICKETID##'}}, `
    @{Name="SNOWIncidentId";Expression={$_.customColumns.'##EXTERNALTICKETID##'.split(':')[1].trim()}}, `
    @{Name="SNOWLinks";Expression={$_.alertExternalTicketUrl.'servicenowIncidentLinks'}}

You'll need to change (or remove) the filter I've put in for $_.rule -like "*Service Now*" to match whatever your rules are. You should get something like the output below.

Alert ID               : DS8871637
InternalId             : LMD33542811
External_Ticket_ID_RAW : ServiceNow xxxx : INC5147309
SNOWIncidentId         : INC5147309
SNOWLinks              : @{INC5147309=https://xxxxx.service-now.com/now/nav/ui/classic/params/target/incident.do%3Fsys_id%3D82fa6f601bb22a507f1da608b04bcbb9}

Alert ID               : DS8871639
InternalId             : LMD33542820
External_Ticket_ID_RAW : ServiceNow xxxxx : INC5147311
SNOWIncidentId         : INC5147311
SNOWLinks              : @{INC5147311=https://xxxxx.service-now.com/now/nav/ui/classic/params/target/incident.do%3Fsys_id%3Dab1b27241b766ad006c94043b24bcb1e}

Alert ID               : DS8871640
InternalId             : LMD33542817
External_Ticket_ID_RAW : ServiceNow xxxxx : INC5147312
SNOWIncidentId         : INC5147312
SNOWLinks              : @{INC5147312=https://xxxxx.service-now.com/now/nav/ui/classic/params/target/incident.do%3Fsys_id%3Dfd7b6b241bb22a507f1da608b04bcb49}

Dave Lee

·1 year ago

Or if you want a more clean URL (ok, I had to ask AI how to do this bit!) then you can use the following:

$alerts | where-object {$_.rule -like "*Service Now*" -And !($_.suppressor)} | Select-Object `
    @{Name="Alert ID";Expression={$_.id}}, `
    @{Name="InternalId";Expression={$_.InternalId}}, `
    @{Name="External_Ticket_ID_RAW";Expression={$_.customColumns.'##EXTERNALTICKETID##'}}, `
    @{Name="SNOWIncidentId";Expression={$_.customColumns.'##EXTERNALTICKETID##'.split(':')[1].trim()}}, `
    @{Name="SNOWLink"; Expression={
        $_.alertExternalTicketUrl.servicenowIncidentLinks.PSObject.Properties |
            Select-Object -First 1 | ForEach-Object { $_.Value }
    }}

that will get you something like this

Alert ID               : LL104713609
InternalId             : LML1960249111
External_Ticket_ID_RAW : ServiceNowxxxxx : INC5147303
SNOWIncidentId         : INC5147303
SNOWLink               : https://xxxx.service-now.com/now/nav/ui/classic/params/target/incident.do%3Fsys_id%3D45756be01b722a14d1feeac8b04bcb42

I think you're using ConnectWise rather than Service Now aren't you? I'm assuming that LM stores the ConnectWise URLs in the same way so maybe you can adapt it to pull the URLs out.

Dave Lee

·1 year ago

I used to pull this information by adding the following to the query string:

customColumns=%23%23EXTERNALTICKETID%23%23

which would give you an external "customColumns" object in the returned payload with the fields you request, then you could parse ##EXTENRALTICKETID## by splitting by the colon char and strip the leading space.

"customColumns": { "##EXTERNALTICKETID##": "SCC ServiceNow Integration : INC5132740" }

I've just had a look to see if you could do the same with alertExternalTicketURL but it seems to be in the default output

{
  "id": "DS8824603",
  "ruleId": 30,
  "alertExternalTicketUrl": {
    "servicenowIncidentLinks": {
      "INC5132740": "https://xxxxxxx.service-now.com/now/nav/ui/classic/params/target/incident.do%3Fsys_id%3Db05f563a1b962a10438ced79b04bcb81"
    }
  },
  "tenant": "undefined",
  "alertValue": "1.0",
  "sdted": false,
  "SDT": null,
}

Cole McDonald

OP1 year ago

I'll check my capitalization... it's potentially case sensitive.

Cole McDonald

OP1 year ago

Still no return. Here's the full (nearly) RestAPI URL I'm using:

********.logicmonitor.com/santaba/rest/alert/alerts?customColumns=%23%23EXTERNALTICKETID%23%23&size=1000&offset=0

I get a full return of alerts, filter to ones that would have ticketed in connectwise and should have an EXTERNALTICKETID value present. There is no extra property returned in any of them

Dave Lee

·1 year ago

That's odd. I've just tested with the following URL and I'm getting a customColumns object with ##EXTERNALTICKETID## in it. I'm also getting an alertExternalTicketUrl object that has the Service Now Incident ID and a link to the incident.

This is the URL I'm using.

https://xxxx.logicmonitor.com/santaba/rest/alert/alerts?customColumns=%23%23EXTERNALTICKETID%23%23&size=500&offset=0&filter=startEpoch>:1751907790

Are you passing in the X-Version=3 header? I was just catching up on another thread where that turned out to be the issue, prevented the API returning the full list of properties.

Mike Moniz

·1 year ago

Try "%23%23externalticketid%23%23" (aka without the "25"s).

"%23" coverts to "#" so you want it to be "##externalticketid##". I think the forum might have messed up some archived posts by converting "%" to "%25" so that "%2523" would convert to "%23" literally.

Cole McDonald

OP1 year ago

Still no return for that property

Cole McDonald

OP1 year ago

Sarah_Terry , Do you know if they've removed the ##externalticketid## property access through the RestAPI? you were the hero in the older thread Mike found... Feels like access existed in V1, but doesn't in V3.

Asawari

·1 year ago

Cole_McDonald
LM has added support to fetch custom columns in V3 alerts API.
Please try it out and let us know your feedback thanks.

Cole McDonald

OP1 year ago

Dave_Lee got me where I needed to be. I was able to get his code spliced into mine. Thank you team!

Dave Lee

·1 year ago

Awesome! Glad it was helpful 😃

I just had a thought... it seems the LM PowerShell module has a Get-LMAlert cmdlet that accepts a CustomColumns parameter. I expect that would probably be able to pull the ##EXTERNALTICKETID## column as well:

https://logicmonitor.github.io/lm-powershell-module-docs/documentation/alert-management/get-lmalert/

I've got to admit, I'm still trying to wean myself off the REST API... it's still my first instinct to use it rather than look at the PowerShell module. That said, in some cases it's still nice to go direct to the APIs even in PowerShell, so it can run on stuff that doesn't have the modules installed.

Cole McDonald

OP1 year ago

Most of what I need to do as an automation person for an MSP requires I use raw PS in most cases (thousands of endpoints I'd need to push that out to and can't assume it's in place... I use very few external modules.

Jared Meidal

·1 year ago

I don't have a solution for this, but also would like to see this as a way to fully integrate between LM and CW.

Cole McDonald

OP1 year ago

For what I'm currently trying to accomplish... this working would help as well:

It fails... have to get them from the interface directly and export to CSV... also doesn't show the externalticketid in the output, but does in the interface. Only if you click into each though... so no way to see that data in bulk currently to evaluate behavior of the integration effectively.

Mike Moniz

·1 year ago

Does this still work? ##EXTERNALTICKETID## in Alert API | LogicMonitor - 3391

Cole McDonald

OP1 year ago

I'll be testing this today... that discussion didn't show up in my search here for "externalticketid" prior to making this post.

Cole McDonald

OP1 year ago

Doesn't seem to work... I've tried the customcolumn in a couple of different places in the URL:

https://*.logicmonitor.com/santaba/rest/alert/alerts?customColumns=%2523%2523externalticketid%2523%2523&size=1000&offset=0

it returns the alerts, but there doesn't seem to be any properties in the objects that would contain the results of that query.

1	SUYASH GAIKWAD
2	RR Robin Ratcliffe
3	AH Alejandra Herrera
4	HS Hunter Sparks
5	LT Lily Trbovic
6	AG Asher Guinzy