Steps to reproduce:

• create item

Name:

comm_alarm

Type:

Zabbix trapper

key:

comm_alarm_key

Type of information:

Text

• create trigger like that：

Name：  

AppAlm_{{ITEM.VALUE}.regsub("(.?)__.", \1)}

Expression：

{dggphisprg00916_test233:comm_alarm_key.regexp(alarmstatus:alarm.*alarmlevel\s*:\s*Information.*manualclear\s*:\s*false,1)}=1

PROBLEM event generation mode:

Multiple

OK event closes:

All problems if tag values match

Tag for matching:

AppAlarmId

Tags：

AppAlarmId      -------       {{ITEM.VALUE}.regsub("(.?)_.*alarmid.?)\,.*",  \1_\2)}

BusinessApp      -------        {{ITEM.VALUE}.regsub("(.?)_.*alarmid.?)\,.*",  \1_\2)}

DigitalPlatform     -------       {{ITEM.VALUE}.regsub("DigitalPlatform.*?)(\,|$)", \1)}

MonitoringLayer     -------       {{ITEM.VALUE}.regsub("MonitoringLayer.*?)(\,|$)", \1)}

• send file with command:

zabbix_sender -T -i test.txt

keep timestamps consistent！that‘s important!!!!

Result:
The reported data includes the data that triggers the alarm and the data that restores the alarm, but you will get the same number of alarms as the reported data!

Expected:

In fact, the data I reported included alarms and recovery. What I'd like to get is three recovered alerts.