I currently monitor a page that prints the following health check
<status>
<link type="text/css" id="dark-mode" rel="stylesheet" href=""/>
<style type="text/css" id="dark-mode-custom-style"/>
<cache>ok</cache>
<databaseMaster>error</databaseMaster>
<databaseSlave>error</databaseSlave>
<redis>ok</redis>
<files>ok</files>
</status>
I do it by using the following trigger (this one works)
{host:web.page.regexp[{$HOST_IP},health/check,,[error|warning],,].str(error)}=1
However when trying to go into the detail parsing each individual line response (i.e. database master, in line 5, it can show 3 values, ok, error, and warning, the expression i'm trying to get running goes (this doesn't work)
{host:web.page.regexp[{$HOST_IP},health/check,,[<databaseMaster>error|<databaseMaster>warning],,].str(error)}=1
However despite the syntax and that i can't find anything wrong with it, for the greater than and lower than symbols are not metacharacters, somehow i suspect my regex expression is wrong but i'm not sure how to translate it to pcre so I can match the characters that I want to trigger the alert
Im also wondering if zabbix have a feature that would be better suited for this?
[<databaseMaster>error|<databaseMaster>warning] - you're trying to match either <databaseMaster>error or <databaseMaster>warning, but you're actually matching one character from the list <d,a,t,b,s,e,M,r,>,o,|,w,n,i,g.
[Square brackets] in this case mean "match one character present in the list." Try a capture group instead, which will behave as you're expecting:
(<databaseMaster>error|<databaseMaster>warning)
Check this answer for more info on the difference between parenthesis and square brackets in a regex.