Environment

• Zabbix server and frontend 8.0.0 (tag "8.0.0", commit "c81e276e505"), PostgreSQL 16.15.

Steps to reproduce

1. Create host "corr-test" with four items of type "Zabbix trapper", type of information "Numeric (unsigned)", keys "t1", "t2", "t3" and "t4".
2. Create triggers on this host:
   1. "Old abc", expression "last(/corr-test/t1)=1", tag "svc" with value "abc";
   2. "Old a_c", expression "last(/corr-test/t2)=1", tag "svc" with value "a_c";
   3. "Old xyz", expression "last(/corr-test/t3)=1", tag "svc" with value "xyz";
   4. "Closer", expression "last(/corr-test/t4)=1", tag "close" with value "yes".
3. Go to Data collection → Event processing and click Create event correlation.
4. Set Name "contains a_c". Add condition "New event tag name" equals "close". Add condition "Old event tag value" with Tag "svc", Operator "contains" and Value "a_c".
5. In Operations select Close old events and click Add.
6. After configuration cache update, send value 1 to "t1", "t2" and "t3", for example "zabbix_sender -z 127.0.0.1 -s corr-test -k t1 -o 1".
7. Send value 1 to "t4".
8. Open Monitoring → Problems and run query from block 1.

1. Query

SELECT p.name, pt.value AS svc, p.r_eventid IS NOT NULL AS closed, p.correlationid
FROM problem p
JOIN problem_tag pt ON pt.eventid = p.eventid AND pt.tag = 'svc'
ORDER BY p.eventid;

Result

Monitoring → Problems shows only "Old xyz" and "Closer". Correlation "contains a_c" resolved "Old abc", but "abc" does not contain "a_c":

  name   | svc | closed | correlationid
---------+-----+--------+---------------
 Old abc | abc | t      |            13
 Old a_c | a_c | t      |            13
 Old xyz | xyz | f      |
(3 rows)

Expected

"contains" matches entered text as it is. Documentation says "contains - has the string in the old event tag value" (Global event correlation). Correlation "contains a_c" closes only "Old a_c".
Affects global correlations with "Old event tag value" condition, operators "contains" and "does not contain", when value has "_" or "%".