Can we send cloudwatch alarm via two integration APIs?

[Patrick Yee]

We have two teams in Opsgenie, each set up its own CloudWatch integration. Then we subscribe the two integration API endpoints to our SNS topic to which our CloudWatch alarm publishes.

When the alarm is set on, we expect both teams get the alerts. However, we observe that only the first subscribed API endpoint gets the alert. We tried to unsubscribe the first endpoint and resubscribe then only the second API endpoint gets the alert.

Is this expected? How should we work around that?

Thank you.

[Nick H · Accepted solution]

Hi @Patrick Yee ,

It sounds like the alerts might be getting deduplicated if you have not adjusted the alias field of one or both CloudWatch integrations: 

https://support.atlassian.com/opsgenie/docs/what-is-alert-de-duplication/

Example:

Within each integration's Advanced tab, you can adjust what data parses in the alias field:

By default, the CloudWatch integration parses the {{Region}} - {{AlarmName}} into the alias:

Deduplication can occur across multiple integrations since the alias of an alert only needs to match an open existing Opsgenie alert's alias. 

It'd be worth checking if:

1. The alerts are being deduplicated.
2. If the data being parsed in the alias field is the same.

If the alias is in fact the same across both integrations, we typically see customers parsing more dynamic fields into the alias, or using something hardcoded along with {{Region}} - {{AlarmName}} to differentiate the alerts.

Examples for both integration's alias:

Team 1 - {{Region}} - {{AlarmName}}

Team 2 - {{Region}} - {{AlarmName}}

A few things to Note as well:

• If you adjust the Create Alert action's alias, it should be consistent throughout all other actions (Close, Ack, etc.).
• The Advanced tab of an integration is only included on the Standard and Enterprise plans.

You can also check the Logs under the Settings tab to see if Opsgenie is in fact receiving requests from both integrations.

Hope this helps! Let us know if this is not the case. 

[Patrick Yee]

Thank you @Nick H . I couldn't find the Advanced tab in the integration page, nor can I find the Logs under the Settings tab. Is it possible that it's not available to our current plan? Or is it something about my permission?

EDIT: apparently we are on essential plan, so that's why I cannot see it. So does that mean we don't have other way to work around it?

[Nick H]

If you do not see the Logs tab under the Settings tab, then that's a restriction with your role's permissions. And the Advanced tab is not included on the Essentials plan.

So if these alerts are in fact deduplicating, there isn't much of a workaround since the alias cannot be adjusted.

You could send all CW alerts to one team, and have that team's escalation reroute the alert to the additional team so they're added as a responder:

Both teams would be alerted through this one alert, but as soon as one user ack's the alert, notification would stop for both teams. 

[Patrick Yee]

Thanks again @Nick H . That makes sense. We end up creating two CloudWatch alarms, one for each team.