armiiller

[STAKEHOLDER] {{ctx.incident.id}}{{#if (not ctx.account.hipaanotifications)}} "{{sanitize ctx.incident.title}}"{{/if}}

Status - {{ctx.incident.status}}

armiiller

---
rules:
  - match:
      $timeBetween:
        starttime: '12:00 am'
        endtime: '12:00 pm'
        timezone: 'America/Los_Angeles'
        timeformat: 'hh:mm a'
    actions:
      - type: assign

armiiller

{    
   "incident_key": "${latestEvent.node.name} - ${latestEvent.application.name}",
   "event_type": "${pt_event_type}",
   "description": "${latestEvent.displayName} on ${latestEvent.node.name}",
   "client": "AppDynamics",
   "client_url": "${controllerUrl}",
   "details": {
     "event_name": "${latestEvent.displayName}",
     "summary": "${latestEvent.summaryMessage}",
     "event_id": "${latestEvent.id}",

armiiller

{
  "ID": "$ID",
  "EVENT_TITLE": "$EVENT_TITLE",
  "TEXT_ONLY_MSG": "$TEXT_ONLY_MSG",
  "EVENT_TYPE": "$EVENT_TYPE",
  "LAST_UPDATED": "$LAST_UPDATED",
  "AGGREG_KEY": "$AGGREG_KEY",
  "DATE": "$DATE",
  "USER": "$USER",
  "SNAPSHOT": "$SNAPSHOT",

armiiller

# Alert when the rate of events exceeds a threshold

# (Optional)
# Elasticsearch host
#es_host: localhost

# (Optional)
# Elasticsearch port
#es_port: 9200

armiiller

var pagertree_url = '<PagerTree Endpoint URL>'
var period = 1m
var crit = 90
var warn = 80
var info = 70


var data = stream
   |from()
       .database('telegraf')

armiiller

...
// will look at windows of data so you are not spammed by every datapoint
|window()
    .period(period)
    .every(period)
...
// send the alert to PagerTree with different levels. Only report state changes.
|alert()
    .info(lambda: "value" > info)
    .warn(lambda: "value" > warn)

armiiller

 route:
   # A default receiver
   receiver: pagertree_issues

 receivers:
 - name: 'pagertree_issues'
   webhook_configs:
   - url: '<Copied PagerTree Endpoint URL>'

armiiller

ActionType=Create&NodeName=${NodeName}&AlertID=${N=Alerting;M=AlertID}&AlertMessage=${N=Alerting;M=AlertMessage}&AlertDescription=${N=Alerting;M=AlertDescription}&AlertDetailsUrl=${N=Alerting;M=AlertDetailsUrl}&AcknowledgeUrl=${N=Alerting;M=AcknowledgeUrl}&AlertTriggerCount=${N=Alerting;M=AlertTriggerCount}&AlertTriggerTime=${N=Alerting;M=AlertTriggerTime;F=DateTime}&Severity=${N=Alerting;M=Severity}

armiiller

 ActionType=Resolve&AlertID=${N=Alerting;M=AlertID}