keep icon indicating copy to clipboard operation
keep copied to clipboard

[➕ Feature]: Configurable Alert Deduplication

Open talboren opened this issue 1 year ago • 2 comments

After examining some "alerts", it seems like alert de duplication mechanism can be a lot better and when we consider new alert to be when some value changes, it actually speaks about same alert that could've been deduplicated.

  1. User should be able to configure attributes to exclude per installed/linked provider.
  2. Keep should consider most non-alert related attributes to be deduplicated and only log the change. If this is some incoming alert:
{
  "name": "Some very important alert",
  "status": "firing",
  "severity": "low",
  "value": "5",
  "environment": "prod",
  "service": "api",
  "source": [
    "grafana"
  ]
}

and then there's another incoming alert (value changed to 6)

{
  "name": "Some very important alert",
  "status": "firing",
  "severity": "low",
  "value": "6",
  "environment": "prod",
  "service": "api",
  "source": [
    "grafana"
  ]
}

we consider them as 2 alerts, while only value changed.

thought: maybe we should define the important attributes of an alert and only consider those for deduplication (instead of looking at all attributes today)

This needs to be better defined but could ease a lot of stuff in Keep!

talboren avatar Jul 15 '24 15:07 talboren

The backend side of this is already implemented, we just need some UX and/or opinionated default configuration

shahargl avatar Jul 15 '24 15:07 shahargl

This is alertdeduplicationfilter table

shahargl avatar Jul 15 '24 15:07 shahargl