Microsoft Security Tech Accelerator
Dec 06 2023, 07:00 AM - 12:00 PM (PST)
Microsoft Tech Community

Logic app search replace function usage example?

Iron Contributor
Can someone please give me an example function for search and replace?
I'm using html in the sentinel 'add comments' operator and I'm seeing lots of \n characters.
I want to remove them all so they don't write line feeds to the output and mess up my html markup.

Thank you.
5 Replies
best response confirmed by cmaneiro (Microsoft)

hi @SocInABox 


Not sure if it's the same, but, I've feced something similar with an HTML table where I wanted to include a hyper link using <a href> and Logic App replaced those chars. 


What I did was process the HTML content before using it (Send Email) as an expression 

replace(replace(variables('email_html'), '&lt;', '<'), '&gt;', '>')
Maybe my scenario is simplier than the one you have but hope it helps

Hey @cmaneiro, thanks! that worked for me.

Took me a minute to realize your example was a 'replace inside of a replace', which was more than i needed.


I was able to replace all of the html content containing '\n' with ''   ('' = nothing).


So my solution was:

- collect all variables (which contain html markup) and assign them all to a single variable.

- replace all \n values with nothing.

- use the cleaned up variable in my Sentinel Incident comments.



The result is a much better formatted html with only one line feed between the text body and the table (before there were 8 linefeeds!)




amazing @SocInABox !!!


Glad to help!!!



By the way, for those who doesn't know, you can add html markup to variable operators, but you can't add them to operators which have embedded text editors.

So this is valid because set variable operators don't contain embedded text editors:


( a problem I was having is that all of the variables above automatically include a \n at the end of the variable, so you may have to use the 'replace' function to strip those out)


But you can't add html in here, unless it's contained in the variables.

HTML in the body of the editor will just be printed as text.

The 'IncidentComments' variable can contain html and it will be formatted correctly.




@cmaneiro I don't suppose you've ever tried to embed the 'playbook RUN' button into html?


I'd like to know the structure of the url, or if it's possible to use it.


I expect it's a POST call, so maybe not..



eg. I know the basic playbook url structure is this:
/subscriptions/<tenant>/resourceGroups/<workspace>/providers/Microsoft.Logic/workflows/<playbook name>

But can you add to this url to have it run the playbook for a given Incident or alert?