Errors exporting alerts during `template export`

[alexb5dh]

seqcli template export -o Seq\test -s *** -a ***

If alert has any recent notifications

Error:

The command failed: Unsupported type: Seq.Api.Model.Shared.DateTimeRange. Use the JsonSerializer class to get the object's JSON representation. Path 'Activity.RecentOccurrences[0]'.

JSON:

{
  "Activity": {
    // ...
    "RecentOccurrences": [
      {
        "DetectedAt": "2022-07-25T11:13:06.9765797Z",
        "DetectedOverRange": {
          "Start": "2022-07-25T11:05:36.9765797Z",
          "End": "2022-07-25T11:12:36.9765797Z"
        },
        "NotificationLevel": "Debug",
        "Notifications": [
          {
            "HistoricalAppInstanceId": "appinstance-261"
          }
        ]
      }
      // ...
    ]
  }
}

If Slack app instance allows Message property override

Error:

The command failed: Unsupported type: System.Collections.Generic.KeyValuePair`2[System.String,System.String]. Use the JsonSerializer class to get the object's JSON representation. Path 'NotificationChannels[0].NotificationAppSettingOverrides'.

JSON:

"NotificationChannels": [
  {
    "Id": "notificationchannel-ea922d068c29441ab58d6ea411d4d477",
    "NotificationMessage": "This is test alert notification message",
    "IncludeContributingEvents": true,
    "IncludedContributingEventLimit": 1,
    "NotificationAppInstanceId": "appinstance-261",
    "NotificationAppSettingOverrides": {
      "MessageTemplate": "This is test alert message"
    }
  }
],

Seq 2022.1.7929 Seqcli 2022.1.594 Slack Notifier App 1.0.0

[nblumhardt]

Thanks for the report, @alexb5dh 👍

[danielgauci]

Hi @nblumhardt is this planned for fix? It's affecting our workflow :(

[nblumhardt]

Hi Daniel, thanks for the heads-up! We'll take another look; it's likely to be a couple of weeks away given current commitments, but shouldn't be too complicated :crossed_fingers:

[nblumhardt]

Hi all! We've just merged a fix for this - if you'd like to try out the dev build you can find binaries at:

https://ci.appveyor.com/project/datalust/seqcli/branch/dev/job/1kvhn8j740gbsota/artifacts

Would be great to hear how you go :-)

[danielgauci]

Hi @nblumhardt. Using the dev build the export completed successfully but the import failed:

1. seqcli template export --server=https://seq.domain.com --apikey=xxx -o C:\export from v2022.1
2. seqcli template import --server=http://localhost:5341 --merge --input=C:\export to an existing seq docker instance ( v2022.2)
3. also tried to a fresh seq docker instance seqcli template import --server=http://localhost:5341 --input=C:\export to an existing seq docker instance (v2022.2)

error: Import failed: The referenced template file signal-Egress - FB CAPI.template does not exist or has not been evaluated.

Can see that signal-Egress - FB CAPI.template does exist in the C:\export dir.

[nblumhardt]

Thanks for checking it out; sounds like a different issue, I'll take a look 👍

[nblumhardt]

I think I've got this fixed with #256 (on its way through, now).

Tested using:

seqcli template import --merge -s http://localhost:5341 -i tmp/ -g notificationAppInstanceId=appinstance-19

The notificationAppInstanceId mapping requirement is a little unpleasant if you have multiple output app instances for alert notifications - only one of them can be specified on the command-line, and the app type needs to match in order for settings to line up.

Definitely a big step forwards from where we were a week ago, though! I'll pop another comment here when there are some dev binaries to try. Thanks for all the feedback @danielgauci 🙏

[nblumhardt]

https://ci.appveyor.com/project/datalust/seqcli/branch/dev/job/a18pn9swb39or43u/artifacts - fingers crossed, this time it's sure to work!

[danielgauci]

Partially worked!

Got message The argument 'notificationAppInstanceId' is not defined when trying fresh export from datalust/seq:2022.1.7449 and into a container with same version.

Once I removed the parent property (forgot what this was called but it's two levels up from notificationAppInstanceId) from the exported json files then the import worked 😄

Not a biggie though as we now have a workaround.

Thanks for looking into this 👍

[nblumhardt]

That's great - thanks Daniel!

The notificationAppInstanceId thing is a "working as intended" feature - if imported alerts are going to send notifications then they need to be configured with the id of an app instance to use, which is specified on the seqcli template import command-line, e.g. as -g notificationAppInstanceId=appinstance-19'.

Does this make sense in your case, though? You might be in the best position to make a call on the usefulness of this behavior... I wonder if, for alerts, we should instead just drop off their notification channels, and rely on these being reconfigured by hand after-the-fact? Or is there some other scheme that would make alert import/export work better?

I don't think exporting the apps/app instances would turn out well, because they generally rely on very specific details (endpoint URIs, passwords, etc.) that won't make sense to transfer between systems using templates.

Perhaps another option might be for the import command to find existing app instances somehow and match them up - but there's a lot of room for bad behavior if it gets things wrong 🤔