ElastAlert2 Alert Integration Guide

Push ElastAlert2 alerts to Flashduty via webhook, to achieve automatic alert noise reduction.

In ElastAlert 2

Configure ElastAlert 2 Alerts

Follow the ElastAlert Flashduty push configuration document

Create or edit the alert rule file, for example rules/elastalert2_alert.yaml.
Fill in the flashduty alert type in the alert field.
Fill in the integrated integration key in the flashduty_integration_key field.
The flashduty_title and flashduty_event_status are required fields, and other fields can be filled in as needed. For the field definitions, please refer to the following table.

Field	Required	Type	Definition
title	是	string	The alert title, it cannot exceed `512` characters.
event_status	是	string	The alert status. Enum values (capitalized): Critical：severe, Warning：warning, Info：reminder, Ok：recovery. When specified as Ok, it means automatic recovery of the alert.
alert_key	否	string	The alert identifier, used to update or automatically recover existing alerts. You can customize this value, but it cannot exceed `255` characters. You can also rely on the system to automatically generate this value, which will be returned in the response. If you report a recovery event, this value must exist.
description	否	string	The alert description
check	否	string	The alert check item
resource	否	string	The alert resource
service	否	string	The alert service name
metric	否	string	The alert metric name
group	否	string	The alert group
cluster	否	string	The alert cluster
app	否	string	The alert application
env	否	string	The alert environment

name: "elastalert2 alert"
type: "frequency"
index: "pgy_audit*"
is_enabled: true
num_events: 1
realert:
  minutes: 1
terms_size: 50
scan_entire_timeframe: true
timeframe:
  minutes: 60
timestamp_field: "created_at"
timestamp_type: "unix_ms"
use_strftime_index: false
alert_subject: "Test {0} 123 aa☃ {1}"
alert_subject_args:
  - "account_id"
  - "operation"
alert_text: "Test {0}  123 bb☃ {1}"
alert_text_args:
  - "request_id"
  - "operation_name"
filter:
  - query:
      query_string:
        query: "created_at:*"

# ------- Flashduty ----------------
alert: flashduty
flashduty_integration_key: "xxxx"
flashduty_title: "elastalert2 alert"
flashduty_event_status: "Warning"
flashduty_alert_key: "abc"
flashduty_description: "log error"
flashduty_check: "log error"
flashduty_resource: "10.1.1.1"
flashduty_service: "service1"
flashduty_metric: "error"
flashduty_group: "group1"
flashduty_cluster: "bj"
flashduty_app: "app1"
flashduty_env: "dev"
# ------- Flashduty ----------------

Restart ElastAlert and wait for the alert to trigger.

Skywalking Alert Events Keep Alert Integration Guide

Quick Start

Channels

Incident Management

Post-Mortem

Status Page

Analytics

Integration Settings

Configuration

Advanced

Integrations

Best Practices

ElastAlert2 Alert Integration Guide

In Flashduty

Using Dedicated Integration

Using Shared Integration

In ElastAlert 2

Configure ElastAlert 2 Alerts

​In Flashduty

​Using Dedicated Integration

​Using Shared Integration

​In ElastAlert 2

​Configure ElastAlert 2 Alerts

In Flashduty

Using Dedicated Integration

Using Shared Integration

In ElastAlert 2

Configure ElastAlert 2 Alerts