keep icon indicating copy to clipboard operation
keep copied to clipboard

[🐛 Bug]: [MAPPING] rules not matched correctly cause of hyphen "-"

Open bbcorp opened this issue 5 months ago • 2 comments

Describe the bug When using mapping rules, if you have an hyphen in the CSV, it doesn't match properly. It seems to cut after first hyphen encountered.

ex you have the following entries in your csv:

service_id environment
P02D3VM crownmedia
PBHHGOQ crownmedia-mam-dev

Alerts with environment=crownmedia-mam-stg will be matched with service_id P02D3VM

To Reproduce Steps to reproduce the behavior:

  1. Create a csv mapping list with hypens in names
  2. Go to 'mapping'
  3. Import your csv
  4. Create an alert with environment with hypen
  5. See it doesn't match with the correct mapping.

Expected behavior Mapping enrichment on alerts should match the correct mapping in CSV.

Screenshots

Additional context Could you point me to where is the code of this mapping? It's probably a interpretation issue of hyphen - which is typical in Python.

Example mapping:

service_id environment
P02D3VM crownmedia
PBHHGOQ crownmedia-mam-dev

example alert:

{
  "id": "748f513a-6e4e-4000-a389-ae08913ab28b",
  "name": "Pod api-service-production lacks memory",
  "status": "firing",
  "severity": "critical",
  "lastReceived": "2025-07-14T13:36:39.042Z",
  "firingStartTime": "2025-07-14T13:36:39.042Z",
  "firingStartTimeSinceLastResolved": "2025-07-14T13:36:39.042Z",
  "firingCounter": 1,
  "unresolvedCounter": 1,
  "environment": "crownmedia-mam-dev",
  "isFullDuplicate": false,
  "isPartialDuplicate": false,
  "duplicateReason": null,
  "service": "backend",
  "source": [
    "prometheus"
  ],
  "apiKeyRef": "webhook",
  "message": "The pod api-service-production lacks memory causing high error rate",
  "description": "Due to the lack of memory, the pod api-service-production is experiencing high error rate",
  "description_format": null,
  "pushed": true,
  "event_id": "a7944585-1d62-4054-b897-bf7a3c8c0814",
  "url": "https://www.keephq.dev?alertId=1234",
  "imageUrl": null,
  "labels": {
    "cpu": "88",
    "pod": "api-service-production",
    "memory": "100Mi",
    "region": "us-east-1"
  },
  "fingerprint": "3516a64e-7890-4367-91c2-36ad5ce02d49",
  "deleted": false,
  "dismissUntil": null,
  "dismissed": false,
  "assignee": null,
  "providerId": null,
  "providerType": "prometheus",
  "note": null,
  "startedAt": "2025-07-14 13:59:08",
  "isNoisy": false,
  "incident": null,
  "service_id": "P02D3VM",
  "ticket_url": "https://www.keephq.dev?enrichedTicketId=456",
  "alert_hash": "70ddf6bb0cf7bdf969b41711a2df8ff0fe3247c97a32ca08fde1eff1808a7a98"
}

See incorrect service_id P02D3VM 🔴

Removing line environment: crownmedia in CSV makes it work as expected, service_id PBHHGOQ 🟢

{
  "id": "748f513a-6e4e-4000-a389-ae08913ab28b",
  "name": "Pod api-service-production lacks memory",
  "status": "firing",
  "severity": "critical",
  "lastReceived": "2025-07-14T13:36:39.042Z",
  "firingStartTime": "2025-07-14T13:36:39.042Z",
  "firingStartTimeSinceLastResolved": "2025-07-14T13:36:39.042Z",
  "firingCounter": 1,
  "unresolvedCounter": 1,
  "environment": "crownmedia-mam-dev",
  "isFullDuplicate": false,
  "isPartialDuplicate": false,
  "duplicateReason": null,
  "service": "backend",
  "source": [
    "prometheus"
  ],
  "apiKeyRef": "webhook",
  "message": "The pod api-service-production lacks memory causing high error rate",
  "description": "Due to the lack of memory, the pod api-service-production is experiencing high error rate",
  "description_format": null,
  "pushed": true,
  "event_id": "f602cd96-6241-4b7e-9471-1fc040bb7522",
  "url": "https://www.keephq.dev?alertId=1234",
  "imageUrl": null,
  "labels": {
    "cpu": "88",
    "pod": "api-service-production",
    "memory": "100Mi",
    "region": "us-east-1"
  },
  "fingerprint": "eb598165-e369-41ae-b1b5-3fa6e13cd89a",
  "deleted": false,
  "dismissUntil": null,
  "dismissed": false,
  "assignee": null,
  "providerId": null,
  "providerType": "prometheus",
  "note": null,
  "startedAt": "2025-07-14 14:15:08",
  "isNoisy": false,
  "incident": null,
  "service_id": "PBHHGOQ",
  "ticket_url": "https://www.keephq.dev?enrichedTicketId=456",
  "alert_hash": "930917050eb22298108fc0c308da3b63c7dee3d6adc849c40abfc59f5347766e"
}

bbcorp avatar Jul 14 '25 14:07 bbcorp

Note: I added quotes in the csv file and its not better.

bbcorp avatar Jul 14 '25 14:07 bbcorp

Not a bug, this feature actually use python regex but it's not clearly stated. Basically of your watch strict match you have to add ^ and $ around your pattern like so: ^pattern$

Bottom line, lacking documentation. I will work on this.

bbcorp avatar Aug 12 '25 16:08 bbcorp