# Email Key Extraction and Resolve Examples

The following article gives you a few more examples on how to define regex key extractions for your specific email aggregation and resolve use-cases.

## Extracing an alert key between two strings from the email subject

A very common use case might be a monitoring tool that sends emails containing the actual alert origin embedded in the text like so:

*Some static text (the alert origin) Some information about the state*

These payloads are a perfect fit for ilert's key extraction and auto-resolve feature.\
Lets assume we have the following **email subjects**, which are send to us in two emails following each other:

1. **Service: SuperService BayArea (bayarea.super) is CRITICAL**
2. **Service: SuperService BayArea (bayarea.super) is OK**

We have to setup a regex that extracts the inner service identification to use the extracted value as alert key, which will help us group the incoming emails in a single alert.

*Our regex*: `(?<=Service:)(.*)(?=is)`

In both cases this regex will extract from **Service:** to **is** in the example above **SuperService BayArea (bayarea.super)** which ilert will turn into an alert key hash to automatically map all other incoming emails with the same text to the alert.

By adjusting a few more settings for the email alert source's resolve options, we can also make use of the third part of the subject the state and let all **OK** containing subjects resolve open alerts automatically.

<figure><img src="/files/UuvStTxGQgIplTsk09nK" alt=""><figcaption></figcaption></figure>

In action the timeline will also show us how the incoming subjects change the status of the alert.

<figure><img src="/files/eWzf7mtNDNMb7j6b8SRf" alt=""><figcaption></figcaption></figure>

And with the help of the [alert source logs](/alerting/configure-alerting/alert-sources.md#alert-source-logs) we can also see how the incoming emails are treated (emails that fail to pass filters will also show up here, in case you need more information on why emails are not opening or closing alerts).

{% hint style="info" %}
You may always reach out to our team when having any kind of questions for your integration use case.
{% endhint %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.ilert.com/integrations/inbound-integrations/email/email-key-extraction-and-resolve-examples.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.