---
sourceDocument: Australia IT Operations Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/it-operations-management

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Regex preprocessing behavior in Enrich alert automation

# Regex preprocessing behavior in Enrich alert automation {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 Minute Lesedauer

Explains how Event Management alert automation preprocesses values before applying regex patterns, why matching behavior differs between pre-populated Additional Info JSON fields and free-text sample values, and how
to design regex patterns that work reliably.

## Preprocessing alert fields {#enrich-auto-regex-edge-case__section_mhl_15x_c3c}

Event Management alert automation preprocesses alert field values before evaluating regex patterns. This preprocessing ensures consistent matching in the backend but can lead to different behavior in the UI depending on
how you provide the sample value.

Understanding this behavior helps you build regex patterns that validate correctly and behave as expected at runtime.

## How preprocessing works {#enrich-auto-regex-edge-case__section_adv_b5x_c3c}

During regex evaluation, preprocessing occurs only if the value is a JSON value (JSON inside the Additional Info) regardless of how you enter the Sample Value. The system automatically preprocesses the Sample
Value when you select a pre-populated Additional Info field from the Extract from field drop-down list.  
Before applying regex matching, the backend preprocesses values as follows:

* Removes quote characters (`"`)
* Replaces ": " with "=" (or ":" with "=", if no space is present)
* Converts JSON into `{key=value}`
{#enrich-auto-regex-edge-case__ul_j5l_c5x_c3c}

## Free-text Sample Value limitation {#enrich-auto-regex-edge-case__section_kkg_25x_c3c}

When you manually enter a free-text sample value (for example, when the selected field has no data or when testing without matching events):

* The UI does not preprocess the sample value.
* The backend does preprocess the value during regex matching.
* Regex patterns that work in external tools may not appear as matching in the UI.
{#enrich-auto-regex-edge-case__ul_xdy_g5x_c3c}  
{#enrich-auto-regex-edge-case__table_fhb_hvx_c3c__entry__2}

| Current | Preferred |
|-|-|
| `{"type": "linux_server"}` | `{type=linux_server}` |
| `{"CI_Type": "server"}` | `{CI_Type=server}` |
[Tabelle : 1. Example]

{#enrich-auto-regex-edge-case__table_fhb_hvx_c3c}

## Impact {#enrich-auto-regex-edge-case__section_mjw_35x_c3c}

A mismatch can occur between the value entered in the Sample Value field, and the value the backend evaluates during regex matching.

## Workaround {#enrich-auto-regex-edge-case__section_fsr_k5x_c3c}

Instead of matching JSON structure, match the preprocessed `{key=value}` format:

* Use `{key=value}` instead of `{"key": "value"}`.
* Avoid matching JSON structure (quotes, colons, whitespace).
{#enrich-auto-regex-edge-case__ul_vzn_l5x_c3c}