you were right all good now
Fantastic - thanks for letting us know!
Hi @philweber - Just implemented this new alerts dashboard using your webhook. Awesome stuff!
I am trying to work out how I can show a Billboard type query that shows a count of the currently open and currently warning alerts (with thresholds set so it is red if more than one alert is open)
Its a bit tricky, as the records just get added, not updated .
So if I use this query :
SELECT count(incident_id) from alert WHERE severity = ‘CRITICAL’ and current_state = ‘open’
It shows that I have one open alert. But that alert has since been closed.
Any ideas how I do this?
Hi, @brett.howells: Since I posted this, the Alerts team has added a
duration element to the JSON payload. I wonder it you can query for
WHERE duration IS NULL?
Sadly not. It appears that the duration is also set for the open ones.
They do appear to be set to maybe a default value. My first open alert has a duration value of 3,653 and the second has 3,655 - where as the closed alert record has a value of 222,232
If the records are not updated, and this duration is set to a default or at least a low value, perhaps I could do something like:
SELECT count(incident_id) FROM alert WHERE duration /1000 <= 4 and current_state = ‘open’
Actually, just closed of an alert and that also doesnt work, because that record is still there.
I need to somehow take the latest timestamp for an incident ID into account?
Or not count it if there is another record that is closed with the same incident id?
Another thing I just noticed - Warning alerts do not appear to be sent to the new alert table in insights.
Only CRITICAL alerts get sent over. Is this because there is no alerting set on alert conditions?
One more thing @philweber - I can see a few people asking how we select the app name when posting to insights.
I am currently passing : “targets”: “$TARGETS”,
That looks like an array, so how do I either flatten that, or maybe just send the first target?