Rest API integration close alert based on alias

[Charalampos Kailantzis]

Hi there,

I'm trying to replicate similar behaviour to this question behaviour https://community.atlassian.com/t5/Opsgenie-questions/Can-we-close-alerts-in-Opsgenie-with-email-integration/qaq-p/1642680, but in the case using the REST API integration, using the following settings

message sample (ERROR): [Product Environment] A-Service: ERROR

message sample (SUCCESS):  [Product Environment] A-Service: SUCCESS

The idea is to create an alert with message contains ERROR, 

Close the error alert with same alias when new message contains SUCCESS

Creation on ERROR works fine, but for SUCCESS message it logs "Can not execute alert action. Incoming data does not match any actions." and alias in this case is empty "" + and previous ERROR alert remains open of course.

Any advice/hints on what I'm doing wrong ? See attached screenshots.

Thanks in advance.

[Nick Haller · Accepted solution]

Hi @Charalampos Kailantzis ,

I believe your issue is be due to the Rest API using a different URL or endpoint to close and alert vs. creating one: https://docs.opsgenie.com/docs/alert-api#close-alert

And what I believe is happening is the request being sent Opsgenie is probably using the URL to create an alert - so that error in the logs would make sense with no matching action found in the Create Alert action.

The URL needed to close the alert might be something like:

https://api.opsgenie.com/v2/alerts/%5BProduct%20Environment%5D%20A-Service/close?identifierType=alias

or one of the other options we have available to close an alert through the API. Here's a test as well for example through Postman:

Hope that helps! Let us know if you have any other questions.

[Charalampos Kailantzis]

Checking now the logs more carefully:

• alias [Product Environment] A-Service
• message [Product Environment] A-Service: ERROR

any idea why the message still contains "ERROR", when in the body I have "SUCCESS". ??. Or I'm missing something ? I'm also using Postman for testing this.

[Nick Haller]

Closing the alert through the API would not change the message of the alert. You could update the alert's message through an API call or in the UI: https://docs.opsgenie.com/docs/alert-api-continued#update-alert-message

[Charalampos Kailantzis]

HI @Nick Haller ,

Understood. But in your example screenshot in postman, I see a 'message' field defined in the body for 'close' alert call, or I'm seeing it in the wrong way ?

The use case behind my question, is that there is a custom monitoring 'ERROR' and 'SUCCESS' solution for various services and environments that creates alerts in opsgenie when a service is Down. The question was how to make use of the rest API integration filters/conditions then in order to close an ERROR alert when same service is up again. Is it possible only via the close alert api ? 

[Nick Haller]

That is correct - in my example I defined the message field in the close alert request body.

But I'm realizing that the Close Alert action of the API integration might not be able to filter on the Message of the alert - so I do apologize for misleading you here. It's different than other integrations - like the Email integration with the other community post you shared.

You could alternatively have the Close Alert action act like a catch-all - matching on all alerts that do not match on a Create Alert action, and that would work through an API request:

 

[Charalampos Kailantzis]

Hi @Nick Haller 

Thanks for the clarification.

I tried the close api alert with the filter set to "match all alerts", even set the allias field to: {{alias}}, for the close action, instead of the substring function, and the alert was closed successfully (with empty body payload).

Thanks for your help!

[Charalampos Kailantzis]

hi @Nick Haller , 

thanks for your reply. I changed the call to the close alert, and used exaclty same paradigm. So while I still see the

"result": "Request will be processed"

in the response of the 'Close" api call. still the message is the same in the logs  "Can not execute alert action. Incoming data does not match any actions.".

Message sample that I sent is: 

"[Product Environment] A-Service: SUCCESS"

which means, that the alias is found I guess, is just a problem with the rules/conditions in the integration maybe ?

Thank you.