Anyway to add an extra alias check for deduplication?

[Yeefong Aunn]

We are facing an issue where the subject with unique timestamp is parse into the alias field. And since Opsgenie does deduplication by unique alias, alerts kept getting created. Is there a way where we can have another alias field as an additional check? For example the other alias field will check the source of where it comes from.

[Tom Russell]

@Yeefong Aunn is the alias that's being passed in a consistent format? If so, you can use the 'extract' string processing function to change your alias and strip out the date. If you don't want this done for all alerts, add a new 'Create Alert' block that only processes the alerts where you want the alias edited.

[Nick Haller]

What @Tom Russell mentioned, that would also be my suggestion.

Here's some documentation on string processing, and regex, which customers also leverage to extract data into alert / fields. 

[Tom Russell]

As an example, if your incoming alias was:

"Here is my alias with date of 6/5/2022"

You could set the alias field in the integration to:

{{alias.extract(/(.*) with date of \d{1,2}\/\d{1,2}\/\d{2,4}/)}}

or just simply:

{{alias.extract(/(.*) with date of .*/)}}

and your alias would end up the same, no matter the date:

"Here is my alias"

[Yeefong Aunn]

There is too many variable to define as it will include date, time, email addresses and the alias content is not fixed.

What i'm looking for is:

Example:
Subject: Alert on date 06/05/2022 2350
Source of alert: xyz@email.com

Subject: Alert for abc@email.com on date 06/05/2022 2355
Source of alert: xyz@email.com

Subject: Alert on date 06/05/2022 2359 from abc@email.com 
Source of alert: xyz@email.com

We are getting new alerts each time since the subject is different and the subject is parsed in as the alias field. However, what we wanna do is deduplicate based on alias field which contains 2 fields (i.e: first looking at the Source of Alert as condition 1, followed by Subject as condition 2). This way we only handle 1 alert since the source of the alert is the same.

[Tom Russell]

@Yeefong Aunn If there is that much variability in your subject line/current alias, you have some options:

• Try to standardize the alerts coming in (probably not feasible).
• Setup a "Create Alert" block in the integration for each variation that you will be receiving. Your extract function can change to match what's coming in.
• Extract text from the message for your alias, if there is more consistency in the way it is formatted.