nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Can we close alerts in Opsgenie with email integration

Chethan GR_5pzht3

We have a requirement where in alerts will be created via email integration in Opsgenie when some service is down and once the service is back it will trigger another email and it will have something in the email body saying the status is ok. So can we match this and close the alert automatically in Opsgenie.

I tried all the options to match text in Subject, Message in Advanced option in integration but no luck, it keeps on adding the ticket count instead of closing it.

Accepted answers

All comments

connor mcguane

What do you mean "adding to the ticket count"? Adding new messages via deduplication (I assume).

You would need to match your close criteria and then create a Close action in the integration, rather than under the Create Alert tab. Even with that, its still not working?

Chethan GR_5pzht3

Hi @connor mcguane ,

Yes, that's correct it's deduplication.

And I've tried the close action but didn't help. attaching the screenshot for reference.

Regards,

Chethan

Nick Haller

Hi @Chethan GR ,

This use case is certainly possible! It's all dependent on the alias field - or the alert's unique identifier - of both the create and close alerts.

In order for the integration to close an alert, it needs to find an open existing Opsgenie alert with a matching alias. You can define what data parsed in the alias field of both actions - but again, the key is they need to match.

Here's a very basic example:

Hope this helps! Here's a few other documents customers leverage to help customize what data parses in the alias or other alert fields:

https://docs.opsgenie.com/docs/string-processing-methods

https://docs.opsgenie.com/docs/regular-expressions

Let us know if you have any additional questions.

Chethan GR_5pzht3

Hi @Nick Haller ,

I tried the same but it keeps on deduplicating. Please find the screenshots attached.

Please let me know if I'm missing something here.

Regards,

Chethan

Nick Haller

Hi @Chethan GR ,

That setup looks good - so I have to assume the second email is in fact containing "Down" in the subject - which is why it's deduplicating.

If that's the case then the alert will continue to use that action since it matches. You need to filter on something that does not match the Create Alert action's filter - and has the opportunity to review the Close Alert action.

Otherwise, the alerts will continue to deduplicate like this.

tabpws

Hi @Nick Haller

I am also getting alerts deduplicating because of the alias being the same. Isn't this is what distinguishes alerts? Shouldn't both emails both have the same alias?

Initial email has subject of "State: DOWN"

Second email has subject of "Server is now OK"

I have my closing alert to have the exact same settings you instructed but I still get deduplicating

Nick Haller

Hi @Chethan GR ,

I reviewed a previous screenshot of yours, and like I had mentioned - "That setup looks good - so I have to assume the second email is in fact containing 'Down' in the subject - which is why it's deduplicating" - that did appear to be the case:

So your integration's Create Alert action would be matching on that since Subject Contains "Down" - even though "Okay" is also in the subject as well.

You'd want to add an additional condition to the Create Alert action's filter to avoid deduplicating on these alerts. That'd look something like this:

BrewCityDBA

Hi @Nick Haller ,

I have followed this exact method and the outcome is the close alert rule is closing any open alert from that integration. I have verified that the aliases between the these alerts are unique and they are being grouped by default by those aliases.

Have you run into this issue before where the close alert rule closes every alert even though the alias between alerts is unique? Screenshot 2022-08-24 103441.png Screenshot 2022-08-24 103350.png

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

cloud

opsgenie