AlertSource Variable Information Overload in Slack Connection

Comments

3 comments

  • Avatar
    Brian Bozzello

    Hi Cameron,

    By default, {{AlertSource}} will include all tags associated with the alerting metric (we'll update the docs to correct that!). In the meantime, if you'd like to cut down on the fields, you can modify your query to aggregate by the tags of interest. For example:

    In that case, the Disk_Available will be summed up by each _sourceHost, and the resulting alert would only contain the specific host that triggered.

    Additionally, we have an outstanding feature request to allow you to choose the fields to show in a webhook payload from Metrics Monitors - feel free to vote and add comments here: https://ideas.sumologic.com/ideas/SL-I-2602

    Let me know if that helps!

    Thanks,

    Brian

    0
    Comment actions Permalink
  • Avatar
    Cameron Ditchfield

    Hello Brian,

    That's a cleaver trick!
    Due to some peculiarities of our setup summing by _sourceHost didn't work for me, but tacking on  "| sum by _collector, DevName, DirName" did the trick, and the Source message in alerts is looking much cleaner now.
    When I first saw your comment I didn't think this would work for me ("I don't want to modify the values in my time-series, I just want to get rid of columns in the legend!"), but thinking of sum as a merge operation (which any operation to exclude legend columns would have to do) made me realize what was going on.

    Cheers,
    Cameron

    0
    Comment actions Permalink
  • Avatar
    Brian Bozzello

    Great, glad that worked! Let me know if I can help answer any other questions.

    Brian

    0
    Comment actions Permalink

Please sign in to leave a comment.