Create
cancel
Showing results for 
Search instead for 
Did you mean: 
Sign up Log in

Can we close alerts in Opsgenie with email integration

Chethan GR
Rising Star
Rising Star
Rising Stars are recognized for providing high-quality answers to other users. Rising Stars receive a certificate of achievement and are on the path to becoming Community Leaders.
March 19, 2021

We have a requirement where in alerts will be created via email integration in Opsgenie when some service is down and once the service is back it will trigger another email and it will have something in the email body saying the status is ok. So can we match this and close the alert automatically in Opsgenie.

 

I tried all the options to match text in Subject, Message in Advanced option in integration but no luck, it keeps on adding the ticket count instead of closing it.

2 answers

1 vote
Nick H
Atlassian Team
Atlassian Team members are employees working across the company in a wide variety of roles.
March 19, 2021

Hi @Chethan GR ,

This use case is certainly possible! It's all dependent on the alias field - or the alert's unique identifier - of both the create and close alerts.

In order for the integration to close an alert, it needs to find an open existing Opsgenie alert with a matching alias. You can define what data parsed in the alias field of both actions - but again, the key is they need to match.

Here's a very basic example:

emailcomm11.jpgemailcomm22.jpgemailcomm33.jpg

 

emailcomm44.jpgemailcomm55.jpg

 

Hope this helps! Here's a few other documents customers leverage to help customize what data parses in the alias or other alert fields:

https://docs.opsgenie.com/docs/string-processing-methods

https://docs.opsgenie.com/docs/regular-expressions

Let us know if you have any additional questions. 

Chethan GR
Rising Star
Rising Star
Rising Stars are recognized for providing high-quality answers to other users. Rising Stars receive a certificate of achievement and are on the path to becoming Community Leaders.
March 21, 2021

Hi @Nick H ,

 

I tried the same but it keeps on deduplicating. Please find the screenshots attached.

 

Alert.PNGAlert-2.PNGClose.PNGcreate.PNG

 

Please let me know if I'm missing something here.

 

Regards,

Chethan

Nick H
Atlassian Team
Atlassian Team members are employees working across the company in a wide variety of roles.
March 22, 2021

Hi @Chethan GR ,

That setup looks good - so I have to assume the second email is in fact containing "Down" in the subject - which is why it's deduplicating. 

If that's the case then the alert will continue to use that action since it matches. You need to filter on something that does not match the Create Alert action's filter - and has the opportunity to review the Close Alert action.

Otherwise, the alerts will continue to deduplicate like this.

tabpws
I'm New Here
I'm New Here
Those new to the Atlassian Community have posted less than three times. Give them a warm welcome!
October 25, 2021

Hi @Nick H 

I am also getting alerts deduplicating because of the alias being the same. Isn't this is what distinguishes alerts? Shouldn't both emails both have the same alias?

Initial email has subject of "State: DOWN"

Second email has subject of "Server is now OK"

I have my closing alert to have the exact same settings you instructed but I still get deduplicating

Nick H
Atlassian Team
Atlassian Team members are employees working across the company in a wide variety of roles.
October 25, 2021

Hi @tabpws ,

Yes - the alias is the unique identifier of an alert and helps Opsgenie distinguish whether or not an alert should be deduplicated, closed through an integration, etc.

If your alert is deduplicating instead of closing the alert, then it's matching on an integration's Create Alert action - so Opsgenie does not have the chance to review the Close Alert action(s).

All of the actions listed in an integration follow an order of operations. Opsgenie will review these actions from top >> down starting with the Ignore actions >> Create >> Close >> Ack >> Add Note. So order matters because once Opsgenie matches on an action, that action will be used.

If your alerts are still deduplicating, but should be closing, you'd probably have to add another condition into the Create Alert action - maybe something that does NOT contain a piece of data. You can reference my last response at the bottom of this Community post.

0 votes
connor mcguane March 19, 2021

What do you mean "adding to the ticket count"?  Adding new messages via deduplication (I assume).

You would need to match your close criteria and then create a Close action in the integration, rather than under the Create Alert tab.   Even with that, its still not working?

Chethan GR
Rising Star
Rising Star
Rising Stars are recognized for providing high-quality answers to other users. Rising Stars receive a certificate of achievement and are on the path to becoming Community Leaders.
March 19, 2021

Hi @connor mcguane ,

 

Yes, that's correct it's deduplication.

 

And I've tried the close action but didn't help. attaching the screenshot for reference.

Close.PNG

Regards,

Chethan

Nick H
Atlassian Team
Atlassian Team members are employees working across the company in a wide variety of roles.
October 25, 2021

Hi @Chethan GR ,

I reviewed a previous screenshot of yours, and like I had mentioned - "That setup looks good - so I have to assume the second email is in fact containing 'Down' in the subject - which is why it's deduplicating" - that did appear to be the case:

emailcomm1.jpg

So your integration's Create Alert action would be matching on that since Subject Contains "Down" - even though "Okay" is also in the subject as well.

You'd want to add an additional condition to the Create Alert action's filter to avoid deduplicating on these alerts. That'd look something like this:

emailcomm2.jpg

Ryan Fields
I'm New Here
I'm New Here
Those new to the Atlassian Community have posted less than three times. Give them a warm welcome!
August 24, 2022

Hi @Nick H ,

I have followed this exact method and the outcome is the close alert rule is closing any open alert from that integration.  I have verified that the aliases between the these alerts are unique and they are being grouped by default by those aliases.  

Have you run into this issue before where the close alert rule closes every alert even though the alias between alerts is unique?Screenshot 2022-08-24 103441.pngScreenshot 2022-08-24 103350.png

Nick H
Atlassian Team
Atlassian Team members are employees working across the company in a wide variety of roles.
August 24, 2022

Hi @BrewCityDBA ,

I cannot say I've come across that because Opsgenie only closes alerts through an integration when the alias of the close action matches the alias of an open existing alert. A close request can only close one open alert at a time as well - which would make sense because two alerts cannot live in an open state with the same alias.

Like Ryan Fields likes this
Ryan Fields
I'm New Here
I'm New Here
Those new to the Atlassian Community have posted less than three times. Give them a warm welcome!
August 24, 2022

The alert behind this integration was sending an extra closing email in a loop I had not accounted for.  The alias was matching and closing as expected.  Thanks for the quick response!

Like Nick H likes this

Suggest an answer

Log in or Sign up to answer
DEPLOYMENT TYPE
CLOUD
PERMISSIONS LEVEL
Site Admin
TAGS
AUG Leaders

Atlassian Community Events