Add new note to alert on deduplication

Question

The idea of duduplication is great when it comes to reducing alert fatigue.

But in practice there is a possiblity of essential information being missed as on duduplication, the alert's message/description does not change.

In the following question, the answer mentioned that a note could be created on a deduplication event, detailing any new information:

https://community.atlassian.com/t5/Opsgenie-questions/Can-I-update-alert-field-message-with-latest-deduplicated-alert/qaq-p/1712754

However, I have not found any information on how this would actually be set up in the settings of a given integration. (for example Sumo Logic.)

This is our current flow which I dont think will work:

CREATE ALERT

Rule: If action equals create and alias equals terminated_instance, create alert with P2 priority

CLOSE ALERT

Rule: If action equals recover then close alert

ADD NOTE TO ALERT

Rule if action equals create and alias equals terminated_instance, create note

The reason it wont work is that it will always go into 'Create Alert' logically, if action equals create and alias equals terminated instance. So it will never reach the 'Add Note' logic. Am I right?

Can anyone give some guidance?

Cameron McAuley · Answer

Thanks @Wei Wung

This information helps a lot.

I notice you left the {{note}} within the field. Is that required?

Thanks

Wei Wung_1nhdec · Answer

Hi @Cameron McAuley

Thank you for reaching out!  It is the deduplication process (as you correctly pointed out, the Create Alert rule) that you would use to update the Note field when the alert is deduplicated.  How this is done is actually very simple.

For example, if you need the alert message and description to be added as a new entry in the Note field each time there is a deduplication, you would do the following:

* Edit the Create Alert rule of the integration in question
* Copy the configurations from the Message field and the Description field and paste them into the Note field and save the Create Alert rule.
* Shown below is an example screenshot for the Create Alert rule of the Sumo Logic integration:

What this will do is that each time the Create Alert rule is triggered, all the information that is parsed for the Message and Description fields will get added to the Note field.  This will happen during alert creation as well as alert deduplication.

As for notifications, no "Add Note" notification will be sent out since the Note is added by the Create Alert rule as part of the deduplication process due to an Open alert having the same alias value.

Hope the above answers your question.

Best Regards,

~Wei

Cameron McAuley · Answer

Ok so the problem is the action field.It needs to be unique or else it wont go to the note logic.

But it can't be unique as all payloads coming from sumologic will have 'create'.

And even if it was unique and a note is added, that means that the Alert count will not increase as this time it doesn't enter the 'Create Alert' logic...