Can we close alerts in Opsgenie with email integration

[Chethan GR]

We have a requirement where in alerts will be created via email integration in Opsgenie when some service is down and once the service is back it will trigger another email and it will have something in the email body saying the status is ok. So can we match this and close the alert automatically in Opsgenie.

I tried all the options to match text in Subject, Message in Advanced option in integration but no luck, it keeps on adding the ticket count instead of closing it.

[Nick H]

Hi @Chethan GR ,

This use case is certainly possible! It's all dependent on the alias field - or the alert's unique identifier - of both the create and close alerts.

In order for the integration to close an alert, it needs to find an open existing Opsgenie alert with a matching alias. You can define what data parsed in the alias field of both actions - but again, the key is they need to match.

Here's a very basic example:

Hope this helps! Here's a few other documents customers leverage to help customize what data parses in the alias or other alert fields:

https://docs.opsgenie.com/docs/string-processing-methods

https://docs.opsgenie.com/docs/regular-expressions

Let us know if you have any additional questions. 

[Chethan GR]

Hi @Nick H ,

I tried the same but it keeps on deduplicating. Please find the screenshots attached.

Please let me know if I'm missing something here.

Regards,

Chethan

[Nick H]

Hi @Chethan GR ,

That setup looks good - so I have to assume the second email is in fact containing "Down" in the subject - which is why it's deduplicating. 

If that's the case then the alert will continue to use that action since it matches. You need to filter on something that does not match the Create Alert action's filter - and has the opportunity to review the Close Alert action.

Otherwise, the alerts will continue to deduplicate like this.

[tabpws]

Hi @Nick H 

I am also getting alerts deduplicating because of the alias being the same. Isn't this is what distinguishes alerts? Shouldn't both emails both have the same alias?

Initial email has subject of "State: DOWN"

Second email has subject of "Server is now OK"

I have my closing alert to have the exact same settings you instructed but I still get deduplicating

[Nick H]

Hi @tabpws ,

Yes - the alias is the unique identifier of an alert and helps Opsgenie distinguish whether or not an alert should be deduplicated, closed through an integration, etc.

If your alert is deduplicating instead of closing the alert, then it's matching on an integration's Create Alert action - so Opsgenie does not have the chance to review the Close Alert action(s).

All of the actions listed in an integration follow an order of operations. Opsgenie will review these actions from top >> down starting with the Ignore actions >> Create >> Close >> Ack >> Add Note. So order matters because once Opsgenie matches on an action, that action will be used.

If your alerts are still deduplicating, but should be closing, you'd probably have to add another condition into the Create Alert action - maybe something that does NOT contain a piece of data. You can reference my last response at the bottom of this Community post.

[connor mcguane]

What do you mean "adding to the ticket count"?  Adding new messages via deduplication (I assume).

You would need to match your close criteria and then create a Close action in the integration, rather than under the Create Alert tab.   Even with that, its still not working?

[Chethan GR]

Hi @connor mcguane ,

Yes, that's correct it's deduplication.

And I've tried the close action but didn't help. attaching the screenshot for reference.

Regards,

Chethan

[Nick H]

Hi @Chethan GR ,

I reviewed a previous screenshot of yours, and like I had mentioned - "That setup looks good - so I have to assume the second email is in fact containing 'Down' in the subject - which is why it's deduplicating" - that did appear to be the case:

So your integration's Create Alert action would be matching on that since Subject Contains "Down" - even though "Okay" is also in the subject as well.

You'd want to add an additional condition to the Create Alert action's filter to avoid deduplicating on these alerts. That'd look something like this:

[BrewCityDBA]

Hi @Nick H ,

I have followed this exact method and the outcome is the close alert rule is closing any open alert from that integration.  I have verified that the aliases between the these alerts are unique and they are being grouped by default by those aliases.  

Have you run into this issue before where the close alert rule closes every alert even though the alias between alerts is unique?

[Nick H]

Hi @BrewCityDBA ,

I cannot say I've come across that because Opsgenie only closes alerts through an integration when the alias of the close action matches the alias of an open existing alert. A close request can only close one open alert at a time as well - which would make sense because two alerts cannot live in an open state with the same alias.

[BrewCityDBA]

The alert behind this integration was sending an extra closing email in a loop I had not accounted for.  The alias was matching and closing as expected.  Thanks for the quick response!