Account ID parsing failing when using multiple TO addresses (I think)

Hi!

I modified a set of rules imported from another ruleset, all my testing worked fine but I was just notified of a failure.

Having looked through the history, I believe issue is that the variable for the AutoTask account ID is being overwritten because it is parsing on every address in the TO.

So in this case (email addresses in To field are)

  1. [email protected]
  2. [email protected]

So ‘Parse Account ID from Email’ runs against (1), but then returns null because it runs again against (2).

I took a look at the flags for the regex but couldn’t see how to limit that using the flags (checked Perl reference, which I think is what is being used here).

Had a look at the rules in the library, but couldn’t see anything suitable that might work.

Of course I could be wrong about the cause!

If I am correct, is there a way I can force parsing of email To address to stop once we’ve matched on SaaSBackup_########@backups.example.com? We are using a regex mailbox.

Thank you!

Hey @MattHomewood_QlicIT .

If you can post a link to the history showing this happening, I’ll be able to see what’s happening and provide some good info for you.

Thanks!

@MattHomewood_QlicIT

I just noticed that you sent us the history link to the support address. I have what I need - standby.

@MattHomewood_QlicIT :

I see what’s happening, and it’s a simple fix.

For the sake of background and for others following along, you created a regular expression mailbox called SaaSBackup_########@backups.example.com. Inside that mailbox, you have a rule to extract the ######## portion of the email address, and use that in later steps.

The issue is that you are extracting the ######## value from {{email.to.[0].address_prefix}}, but should instead extract it from {{email.mailbox}}.

{{email.to}} is populated with an array of every email address typed in the email client, and in the order it was typed. In your case, the email address you needed to extract was the second item in the array, not the first, so it could not locate the ######## in the first address (because the first address didn’t include that).

You can read more about the difference between {{email.mailbox}} and {{email.to}} here.

To put it concretely, you will want to change your text extraction from this:

{{after_string email.to.[0].address_prefix "SaaSBackup_" flags="tni"}}

to this:

{{between_string email.mailbox "SaaSBackup_" "@" flags="ti"}}

Legend, thank you Travis - and thanks for the link explaining the differences, very useful.

I will monitor today, we should get another alert through with the dual email addresses and then will post back for the benefit of everyone.

Have a great day! :grinning:

I just noticed, this should be between_strings, not between_string.

Thanks for the catch @travis unfortunately I’m seeing a slightly different issue now which I assume is because of the two email addresses in the To field.

The ticket does get raised into AT correctly, however we also get a ‘Alert did not match any rule’ for the other email address in the To field.

https://console.mspintegrations.com/#/email2at/advanced/history/170688988208608

@MattHomewood_QlicIT

The rule that created that ticket is configured to always send you that email.

I presume you intend for a different rule, earlier in the mailbox, to create the ticket so that it’s not the “Default Ticket” rule. Which rule should have triggered for this email instead of the Create Default Ticket if no rules match rule?

@travis

Thanks, I re-enabled the ‘minor’ mailbox rule (my mistake!) and then replayed both the daily summary (minor) and the error email (severe), seems to all work correctly now.

image

I did receive an exception email but I assume you don’t keep the email attachment when replacing history.

I will monitor on Monday whic is when the next round of alerts will come in.
edit: add screenshot

We do keep the entire email. What exception did you receive about the attachment (or on what history URL did it occur)?

A post was split to a new topic: Autotask API Rejects calls made too quickly in succession