User Problem

Some integrations send fields to Opsgenie as arrays. These fields are limited to only filter using Contains, Contains Key, Contains Value, and Is Empty.

This seems to exist with a few different integrations such as Splunk's Result Object field, Graylog's Event Field field, etc.

Suggested Solutions

Add option to integrations that send array fields to either filter using regex, or an additional field that allows for Key/Value Based filtering - similar to Opsgenie's Details and Details (Key/Value Based) fields:

Current Workarounds

Use the existing options available to filter; Contains, Contains Key, Contains Value, and Is Empty. 

Extract each key/value field into the alert as an extra property (or another alert field):

Then use an Alert policy to filter on where this is extracted after alert creation, and modify the alert following:

Global Alert Policy
Team Alert Policy