Deduplication and Auto Close

[Joe G]

I have this scenario I'm looking for assistance on. These particular email alerts I have integrated into OpsGenie get filtered based on the subject name and assigned an Alias for the deduplication effort. That being "WARNING: server". When the server comes back up, I get a similar subject, but it states "OK: server".  What I'd like to do is auto-close the alert when the OK message happens, but I want to close both the OK alert and the WARNING alert.  Should I make the filter rule for the alias just on the term "server" and group both together, then close on the alias?  Or should I keep the two as separate alerts and manage independently?  Is there a better way of doing this I'm overlooking? 

[Samir Kafel]

Hi Joe - so what you would want to do is setup a filter on the Create Alert action in the email integration for "subject contains WARNING", and then the filter on the Close Alert Action in the email integration would be "subject contains OK". You would want to make sure the alias field in both the Create Alert action, and the Close Alert action are the same. Sounds like you already got the alias configured. So you would just want to setup the Create Alert actions and Close alert actions as described. In the examples below, I have the alias configured to be the substring after the word "ID" in the subject of the email. Let me know if this helps or if you need anymore clarification!

Create Alert Action:

Close Alert Action: