I modified a set of rules imported from another ruleset, all my testing worked fine but I was just notified of a failure.
Having looked through the history, I believe issue is that the variable for the AutoTask account ID is being overwritten because it is parsing on every address in the TO.
So ‘Parse Account ID from Email’ runs against (1), but then returns null because it runs again against (2).
I took a look at the flags for the regex but couldn’t see how to limit that using the flags (checked Perl reference, which I think is what is being used here).
Had a look at the rules in the library, but couldn’t see anything suitable that might work.
Of course I could be wrong about the cause!
If I am correct, is there a way I can force parsing of email To address to stop once we’ve matched on SaaSBackup_########@backups.example.com? We are using a regex mailbox.
For the sake of background and for others following along, you created a regular expression mailbox called SaaSBackup_########@backups.example.com. Inside that mailbox, you have a rule to extract the ######## portion of the email address, and use that in later steps.
The issue is that you are extracting the ######## value from {{email.to.[0].address_prefix}}, but should instead extract it from {{email.mailbox}}.
{{email.to}} is populated with an array of every email address typed in the email client, and in the order it was typed. In your case, the email address you needed to extract was the second item in the array, not the first, so it could not locate the ######## in the first address (because the first address didn’t include that).
You can read more about the difference between {{email.mailbox}} and {{email.to}}here.
To put it concretely, you will want to change your text extraction from this:
Thanks for the catch @travis unfortunately I’m seeing a slightly different issue now which I assume is because of the two email addresses in the To field.
The ticket does get raised into AT correctly, however we also get a ‘Alert did not match any rule’ for the other email address in the To field.
The rule that created that ticket is configured to always send you that email.
I presume you intend for a different rule, earlier in the mailbox, to create the ticket so that it’s not the “Default Ticket” rule. Which rule should have triggered for this email instead of the Create Default Ticket if no rules match rule?
Thanks, I re-enabled the ‘minor’ mailbox rule (my mistake!) and then replayed both the daily summary (minor) and the error email (severe), seems to all work correctly now.
I did receive an exception email but I assume you don’t keep the email attachment when replacing history.
I will monitor on Monday whic is when the next round of alerts will come in.
edit: add screenshot
