Showing results for 
Search instead for 
Did you mean: 
Sign up Log in

Alias for auto-close alerts from Amazon SNS via HTTPS

Andrii Ovcharenko April 1, 2020

Hi. We setup notification from Amazon SNS to https endpoint in Opsgenie. Alert contains a specific hostname like Please advise how we can setup aliases for auto-closing alerts after receiving status OK.


1 answer

0 votes
Atlassian Team
Atlassian Team members are employees working across the company in a wide variety of roles.
July 1, 2020

Hi @Andrii Ovcharenko

For the SNS integration, you may need to customize the Alias and filter conditions based on the type of alerts you're sending through it. Here's a short guide on how to set extract specific fields/data from the SNS integration payload using dynamic fields and string processing methods:

Amazon Incoming SNS Integration

This payload is from an Incoming SNS integration. The most important information is usually in the Message field, which is sent to Opsgenie as escaped JSON - meaning Opsgenie just treats the whole thing as a massive blob of text. You can see this under Settings > Debug > Logs in the web application:

    "Type": "Notification",
    "MessageId": "1d8a9ec9-5536-594e-bbbb-cbb85b720e50",
    "TopicArn": "arn:aws:sns:us-east-1:1234567890:cloudwatch_alarm_sns",
    "Subject": "OK: \"lambda_invocation_total\" in US East (N. Virginia)",
    "Message": "{\"AlarmName\":\"lambda_invocation_total\",\"AlarmDescription\":null,\"AWSAccountId\":\"1234567890\",\"NewStateValue\":\"OK\",\"NewStateReason\":\"Threshold Crossed: 1 datapoint [1.0 (05/06/19 00:20:00)] was not greater than or equal to the threshold (2.0).\",\"StateChangeTime\":\"2019-06-05T00:25:40.667+0000\",\"Region\":\"US East (N. Virginia)\",\"OldStateValue\":\"INSUFFICIENT_DATA\",\"Trigger\":{\"MetricName\":\"Invocations\",\"Namespace\":\"AWS/Lambda\",\"StatisticType\":\"Statistic\",\"Statistic\":\"AVERAGE\",\"Unit\":null,\"Dimensions\":[],\"Period\":300,\"EvaluationPeriods\":1,\"ComparisonOperator\":\"GreaterThanOrEqualToThreshold\",\"Threshold\":2.0,\"TreatMissingData\":\"- TreatMissingData: notBreaching\",\"EvaluateLowSampleCountPercentile\":\"\"}}",
    "Timestamp": "2019-06-05T00:25:40.723Z",
    "SignatureVersion": "1",
    "Signature": "RKIlc+yaxHTR55cFqB/4+FDjtQB53qVbtWjiuaGxMJ6XWEk5eNtIdcPUmmbghHwvlKhZ6y9Y19qOmdHVuILE4nW7Zr3R1TO12Sy3iQM4KVjMAU6cPkORPyp3J2Q0XHaz0ayinN+6RBaXCV9OcQn/cTg/rwsrny+itsJHJ7t4VGfnUyAxmL7XNnl9jFszSLa21JTcxL/TLbS09hb0gy1gB4ROU7EJR/YPqCHAJxAjDDyIxHKfKheMozQ12E0E6q4oiWtVXLhj9rLRso9FzBwtjGheBxIgfviKCwWiGxZ13A+azYJDDYXgwfEVT7scwEc69NrsAkc/9Mv6sqAz9sgf0g==",
    "SigningCertURL": "",dasdf
    "UnsubscribeURL": ""

Let’s try extracting MetricName:

A quick look at Message shows MetricName is buried pretty deep. Since there’s text on both sides of it, we’ll have to use substringBetween("before", "after"):


Using MetricName should be a good reference for the “before” value, but what about the “after” or the quotes/slashes between them?

Since the quotes and slashes are processed as strings and will always be there, just include them in the substringBefore() statement.

{{Message.substringBetween("MetricName\":\"", "\"")}}

That will let us extractMetricName each time SNS sends us data, no matter what the value is. This time its Invocations. But if the next alarm is for ApproximateNumberOfMessagesVisible, it'll be able to extract that value instead without making any changes.

Suggest an answer

Log in or Sign up to answer
AUG Leaders

Atlassian Community Events