Anyway to add an extra alias check for deduplication?

Question

We are facing an issue where the subject with unique timestamp is parse into the alias field. And since Opsgenie does deduplication by unique alias, alerts kept getting created. Is there a way where we can have another alias field as an additional check? For example the other alias field will check the source of where it comes from.

Tom Russell · Answer

@Yeefong Aunn If there is that much variability in your subject line/current alias, you have some options:

* Try to standardize the alerts coming in (probably not feasible).
* Setup a "Create Alert" block in the integration for each variation that you will be receiving. Your extract function can change to match what's coming in.
* Extract text from the message for your alias, if there is more consistency in the way it is formatted.

Yeefong Aunn · Answer

There is too many variable to define as it will include date, time, email addresses and the alias content is not fixed.

What i'm looking for is:

Example:
Subject: Alert on date 06/05/2022 2350
Source of alert: xyz@email.com

Subject: Alert for abc@email.com on date 06/05/2022 2355
Source of alert: xyz@email.com

Subject: Alert on date 06/05/2022 2359 from abc@email.com 
Source of alert: xyz@email.com

We are getting new alerts each time since the subject is different and the subject is parsed in as the alias field. However, what we wanna do is deduplicate based on alias field which contains 2 fields (i.e: first looking at the Source of Alert as condition 1, followed by Subject as condition 2). This way we only handle 1 alert since the source of the alert is the same.

Tom Russell · Answer

As an example, if your incoming alias was:

"Here is my alias with date of 6/5/2022"

You could set the alias field in the integration to:

{{alias.extract(/(.*) with date of \d{1,2}\/\d{1,2}\/\d{2,4}/)}}

or just simply:

and your alias would end up the same, no matter the date:

"Here is my alias"