Mapping Evaluation Types & Handling Multiple Request Formats | All Quiet Payload Mapping Guide

[0:00:00] Hi there and thanks for joining. In our previous video, we learned everything about the core attributes of an All Quiet incident.

[0:00:10] Now that we know what attributes we need, it's time to learn how we can extract them from the payloads we receive. So this video will be about our mapping types at All Quiet.

[0:00:23] Jumping back to our integration’s payload mapping screen, we can find the latest payloads on top.

[0:00:29] Select any of those and open them in the selected payload window to see the whole HTTP request, its structure, and the information contained.

[0:00:37] Now let's look at the mapping types that All Quiet provides to extract that information and map it into an All Quiet incident. The simplest mapping type is "Static".

[0:00:50] Sometimes you don't need to extract anything. If your specific integration, for example, is always triggering "Open" alerts and won't let you know that an incident has been "Resolved", you can simply type in "Open" as a static value, after selecting "Static" as mapping type.

[0:01:11] No matter what the payload says, All Quiet will always apply this fixed standard to your incident.

[0:01:19] Next we have "JSONPath". This is your primary tool for modern integrations.

[0:01:26] Since we know that the requests we received included JSON objects, we can simply follow the path and extract its values.

[0:01:33] In this case, we want to get the severity and we know that the JSON body included an object called "severity_level". So we can simply select "JSONPath" as mapping type and then see the whole payload in our mapping editor.

[0:01:49] Next we click on "severity_level" and All Quiet grabs the value which in our case is "P1". By the way, if you're working with older enterprise tools or web services that send XML instead of JSON, you can use the "XPath" mapping type instead.

[0:02:15] As we discussed, "Severity" is a required attribute in All Quiet which expects the values "Minor", "Warning", or "Critical". So "P1" should be mapped against "Critical".

[0:02:28] This brings us to the next type - "Map". The "Map" type is incredibly helpful. It acts as a translator.

[0:02:35] Here we can simply define that when the incoming value is "P1", it should be mapped to "Critical". If it's "P2", it becomes "Warning" and so on. So "P3" would be "Minor".

[0:02:51] This ensures that no matter what language your tools speak, All Quiet always understands the urgency. Also, we can add a fallback value if no information is included in the payload or if we forget a to map a value.

[0:03:07] This maps "P1" against All Quiet "Critical".

[0:03:14] Finally, we have "Regex" or "regular expression". Sometimes the data you need is buried inside a long text string. Instead of importing the whole sentence as an attribute, we can use "Regex" to pull out exactly what we need.

[0:03:31] Let's look at the payload above. It includes a raw "error_log" and we want to extract the host name from it.

[0:03:41] So how do we do this? First we add a new attribute that we simply call "Host".

[0:03:51] Now we can add our first mapping step. We need to select "JSONPath" because we need to extract the value from the JSON body object, which is "error_log".

[0:04:07] Now that we got the whole text, we need to find a "Regex" that helps us extract exactly the host name.

[0:04:16] In the second mapping step, we can now add a "Regex". So we select mapping type "Regex" and add our regular expression to carve out the host name from the text.

[0:04:33] Now, "Regex" can be complicated sometimes, but I figured that even if you're not too deep into "Regex", with a little bit of help from AI and knowing what you want to extract, it's quite simple.

[0:04:45] We've successfully extracted the host name. Now, save our mapping and check the instant preview to find the "Host" attribute at the bottom.

[0:05:00] Now we know everything about payload mapping types and how to extract data into an All Quiet incident from a specific part of your payload.

[0:05:07] But what happens if your integration receives different types of data with payloads that include different fields?

[0:05:20] To give you a little example, this payload includes a "CorrelationId" that we extract from the "log_id" field in the JSON body.

[0:05:31] However, another payload might not include a "log_id" field in the JSON body, but we still want to extract the "CorrelationId". Nevertheless, as you can see right now, there's no mapping, meaning there's also no "CorrelationId" that we can extract.

[0:05:52] Here's how you can handle multiple payload formats with one integration. Simply add several entries for the same attribute that evaluate different parts of the payload.

[0:06:11] In this case, simply add a second attribute called "CorrelationId" and use JSONPath to extract another part of the JSON body, in this case "error_id", and save.

[0:06:23] This way, our engine will evaluate incoming requests top to bottom and apply the correct mapping based on the fields present.

[0:06:30] This allows a single All Quiet webhook to act as a unified front door for an entire suite of monitoring scripts or tools, keeping your setup clean and professional.

[0:06:44] Thank you so much for joining. As always, make sure to check out the other videos on our YouTube channel.

[0:06:50] You can also find very helpful content under docs.allquiet.app. See you soon.