Alias for auto-close alerts from Amazon SNS via HTTPS

[Andrii Ovcharenko]

Hi. We setup notification from Amazon SNS to https endpoint in Opsgenie. Alert contains a specific hostname like host-001-host.name. Please advise how we can setup aliases for auto-closing alerts after receiving status OK.

[Robert]

Hi @Andrii Ovcharenko

For the SNS integration, you may need to customize the Alias and filter conditions based on the type of alerts you're sending through it. Here's a short guide on how to set extract specific fields/data from the SNS integration payload using dynamic fields and string processing methods:

Amazon Incoming SNS Integration

This payload is from an Incoming SNS integration. The most important information is usually in the Message field, which is sent to Opsgenie as escaped JSON - meaning Opsgenie just treats the whole thing as a massive blob of text. You can see this under Settings > Debug > Logs in the web application:

{
    "Type": "Notification",
    "MessageId": "1d8a9ec9-5536-594e-bbbb-cbb85b720e50",
    "TopicArn": "arn:aws:sns:us-east-1:1234567890:cloudwatch_alarm_sns",
    "Subject": "OK: \"lambda_invocation_total\" in US East (N. Virginia)",
    "Message": "{\"AlarmName\":\"lambda_invocation_total\",\"AlarmDescription\":null,\"AWSAccountId\":\"1234567890\",\"NewStateValue\":\"OK\",\"NewStateReason\":\"Threshold Crossed: 1 datapoint [1.0 (05/06/19 00:20:00)] was not greater than or equal to the threshold (2.0).\",\"StateChangeTime\":\"2019-06-05T00:25:40.667+0000\",\"Region\":\"US East (N. Virginia)\",\"OldStateValue\":\"INSUFFICIENT_DATA\",\"Trigger\":{\"MetricName\":\"Invocations\",\"Namespace\":\"AWS/Lambda\",\"StatisticType\":\"Statistic\",\"Statistic\":\"AVERAGE\",\"Unit\":null,\"Dimensions\":[],\"Period\":300,\"EvaluationPeriods\":1,\"ComparisonOperator\":\"GreaterThanOrEqualToThreshold\",\"Threshold\":2.0,\"TreatMissingData\":\"- TreatMissingData: notBreaching\",\"EvaluateLowSampleCountPercentile\":\"\"}}",
    "Timestamp": "2019-06-05T00:25:40.723Z",
    "SignatureVersion": "1",
    "Signature": "RKIlc+yaxHTR55cFqB/4+FDjtQB53qVbtWjiuaGxMJ6XWEk5eNtIdcPUmmbghHwvlKhZ6y9Y19qOmdHVuILE4nW7Zr3R1TO12Sy3iQM4KVjMAU6cPkORPyp3J2Q0XHaz0ayinN+6RBaXCV9OcQn/cTg/rwsrny+itsJHJ7t4VGfnUyAxmL7XNnl9jFszSLa21JTcxL/TLbS09hb0gy1gB4ROU7EJR/YPqCHAJxAjDDyIxHKfKheMozQ12E0E6q4oiWtVXLhj9rLRso9FzBwtjGheBxIgfviKCwWiGxZ13A+azYJDDYXgwfEVT7scwEc69NrsAkc/9Mv6sqAz9sgf0g==",
    "SigningCertURL": "https://sns.us-east-1.amazonaws.com/SimpleNotificationService-f.pem",dasdf
    "UnsubscribeURL": "https://sns.us-east-1.amazonaws.com/?Action=Unsubscribe&SubscriptionArn=arn:aws:sns:us-east-1:1234567890:cloudwatch_alarm_sns:4f2c8e78-f5c1-4cf4-95d8-1238e2b42038"
}

Let’s try extracting MetricName:

A quick look at Message shows MetricName is buried pretty deep. Since there’s text on both sides of it, we’ll have to use substringBetween("before", "after"):

"...\"Trigger\":{\"MetricName\":\"Invocations\",\"Namespace\":..."

Using MetricName should be a good reference for the “before” value, but what about the “after” or the quotes/slashes between them?

Since the quotes and slashes are processed as strings and will always be there, just include them in the substringBefore() statement.

{{Message.substringBetween("MetricName\":\"", "\"")}}

That will let us extractMetricName each time SNS sends us data, no matter what the value is. This time its Invocations. But if the next alarm is for ApproximateNumberOfMessagesVisible, it'll be able to extract that value instead without making any changes.