Alert Strategies: More Granular Notification Target Configuration¶

Optimizing Alert Rule Configuration¶

To address complex and ever-changing monitoring environments and enable more flexible alerting for abnormal events, the Alert Strategies feature now includes a "Filter" function. When configuring alert rules, the "Filter" function allows for the addition of more detailed filtering conditions on top of the existing severity level. Only events that match both the severity level and the filtering conditions will be sent to the corresponding notification targets.

Alert Rule Configuration¶

Filter¶

Click the "+" sign next to the notification target to open the filtering condition input box.

Filtering Rules:

1. After clicking "Filter", the current workspace fields are automatically listed. key:value matching supports equals, not equals, wildcard, and wildcard negation.
2. Only one set of filtering conditions can be added under each alert rule. A set of conditions can include one or multiple filtering rules, which are combined for condition screening.

Filtering rules use key:value matching for filtering. Multiple filtering conditions with the same key field have an OR relationship, while filtering conditions with different key fields have an AND relationship.

Configuring Alert Rules¶

The "Filter" function takes effect in notification configurations and can be applied to custom notification time settings and general configurations.

General Notification Configuration¶

Use Case: When all events follow the same notification rules, rules can be configured directly in "Notification Configuration".

• After selecting the event severity level, click the "+" sign next to the notification target and enter the filtering conditions in the pop-up filtering condition box.
• Only events that meet both the severity level and the filtering conditions will be sent to the corresponding notification target.

Custom Notification Time¶

Use Case: When events triggered during specific time periods require alerts to specific members, click "Custom Notification Time" to configure.

• Configure the necessary settings such as cycle and time in "Custom Notification Configuration", select the event severity level, click the "+" sign next to the notification target, and configure the filtering conditions in the pop-up filtering condition input box.
• In the "Other Times" configuration field, select the severity level, click the "+" sign next to the notification target, and configure the filtering conditions in the pop-up filtering condition input box.

Effect:

For alert strategies configured with custom notification times, after a monitor triggers an event, the trigger time is first evaluated. Depending on whether the event trigger time falls within the cycle and time specified in the custom notification configuration, the system will apply either the "Custom Notification Configuration" or the "Other Times" rules. Subsequently, the event will undergo severity level and filtering condition checks. Only events that meet both the severity level and filtering conditions configured in the rules will be sent to the corresponding notification target.

Other Application Scenarios¶

Filtering conditions and severity levels work together as detection rule items to evaluate events and match them to notification targets.

Selecting All Severity Levels¶

Use Case: If a monitor triggers events of any severity level, and events with matching key:value values need to be alerted to specific personnel.

Operation: Select "All" for the severity level, click the "+" sign, and fill in the rules in the filtering conditions. After configuration, abnormal events will only undergo filtering condition checks.

Configuring Multiple Notification Rules for the Same Severity Level¶

The restriction on the number of times a severity level can be selected has been lifted. The same severity level can now be selected and configured in multiple notification rule sets.

Use Case: If a monitor triggers multiple events of the same severity level but with different attributes, and events with different attributes need to be alerted to different targets.

Operation: Configure multiple notification rules, selecting the same severity level for multiple rules and configuring different filtering conditions for each. After selecting the notification targets, alerts can be sent to the corresponding personnel based on the attribute values.

Notification Targets Support Custom External Email Addresses¶

To facilitate better problem resolution, the system now supports sending abnormal alerts to external members. You can directly click the notification target input field and manually enter custom external email addresses.

Scope of Application:

1. When creating a new alert strategy, manually enter the notification target.
2. When creating a new monitor, edit the event details and add via @mention.