Hey ​@ORBroncoFan, 

It's tricky to determine the issue without first reviewing your service and orchestration setup. Assuming you’re sending an event to the Global Email Address (since sending an event to the service email address would bypass Event Orchestration), the event should follow the Global -> Router -> Service Orchestration path.

If in this setup, Service Orchestration is configured with two sets: the first set contains a rule with the condition Always matches and an action to create an Event Field named severity with the value info and then routes to the subsequent set, which has a rule with the condition event.custom_details.severity matches 'info' , -  there should be no issue in triggering an incident.

Also, since there are a few mentions of Custom Fields as well as event.custom_details I wonder if you’re referencing to the same action in EO, which is Event Field.

Here is the setup that worked for the engineer testing this:
 

Thanks so much for the reply!  I derive the severity value in a Trigger Rule:

I know the Custom Field and value is created when I view an ensuing Incident:

And I’m attempting to reference that Custom Field in an Event Rule:  I’ve tried to create the Event Field as you’ve exemplified above (with the exception that my value is derived instead of being a statis string), but I haven’t been able to make it work with the regex.

It’s just that it doesn’t appear the Event Rule is firing...

​@ORBroncoFan Seems like you’re trying to combine Service Email Integration (legacy feature) with the Event Orchestration and this is not supported.

Alternatively, you can create Event Orchestration which will route events to the Service Orchestration and use Global Email routing key, which could be found on Integration tab of created Orchestration, to ingest events.

Then, you can use the setup mentioned in my reply above.

Here is the link for global email integration: https://support.pagerduty.com/main/docs/event-orchestration#send-events-to-global-orchestrations

Ah - I’ll give this a try.  I’ll post back here with the outcome.  Thanks so much for the guidance!

​@xamici , I did what you indicated and placed the logic in the Event Orchestration instead of the Service Event Orchestration, and it worked!  Thanks so much for your help!