Incident Rules are not triggering for Alerts when created

Question

Hi there,

Just working through Opsgenie to get a better understanding of it and am stuck with Incident Rules.

I have alerts coming through for the Billing Service when I create an issue in JSM, works well.

I have a pretty wide Incident Rule in place to just use as a trigger to see it in action, but it won't fire.

As far as I can understand shouldn't this just create an incident based on any Alert coming in for the impacted service of Billing.  I expected it to create a P3 alert with the information in the relevant fields.

I have added other rules to look for specific Status or words also but nothing is firing.

Is there something specific I should be looking at to get this up and running.

I am the admin of the team that is bound to the Billing service and is added as responders to the issue also.

Thanks

Ste404 · Answer

aaahh the alerts were being picked up by the catch all and being associated with the incident that in place.  I got rid of everything, created two rules that had specific phrases in the Description condition and manually created two alerts and two incidents were created.

I created another alert that met one of the rules description conditions and no new incident was created but it was associated with the incident that the rule was relevant to.

Ste404 · Answer

hey I found something weird.  There is an incident created, I created one to make sure it wasn't permissions and such.

The alert rule is firing but it is associating the alerts with this incident and not creating new incidents.

Not quite how I need this to work?!

Nick Haller · Answer

Hi @Ste404 ,

You're theory is correct, and I'm not entirely sure why an incident is not being created when you have the incident rule's filter set to match all alerts.

Here is a test to show what should happen when an incident rule is set to match all alerts:

JSM issue creates Opsgenie alert:

Opsgenie alert is automated into an incident: