Zenoss email filtering

[TinyRick]

I have emails coming from a zenoss box filtered to a Zenoss folder in my mailbox.

Emails have subjects similar to the following:

[zenoss] my.server.domain.tld Windows Service 'Workstation' is down

And a follow up email with the subject:

[zenoss] CLEAR: my.server.domain.tld Windows Service 'Workstation' is up

I'd want the first email to be moved to a new folder based on the incident number that would be located in the body of the email. After the clear email, I'd want it to move it to the same folder as the alert, or to move the email and folders to inbox -> Zenoss ->Cleared emails

[TinyRick]

I tried to edit, but it looks like I can't after a certain amount of time. I apologize for bumping my own thread, but I thought adding more information would be helpful.

1. It appears that Zenoss does not have incident numbers attached to the event so creating a new folder based on the incident doesn't look possible. Maybe creating a folder numerically for each event. (First event would go to folder '1', second would go to '2'). The tricky part would be having the clear email go to the proper folder.

This is what one of the events look like.


Device: Management
Component: mgmthst1
Severity: Critical
Time: 2017/09/05 00:00:35.000
Message:
HTTP CRITICAL - No data received from host
Event Detail
Acknowledge
Delete
Device Events


And this is what a clear of that one looks like

Event: 'HTTP CRITICAL - No data received from host'
Cleared by: 'HTTP OK: HTTP/1.1 302 Moved Temporarily - 535 bytes in 1.593 second response time '
At: 2017/09/05 00:10:38.000
Device: Management
Component: mgmthst1
Severity: Critical
Message:
HTTP CRITICAL - No data received from host