influxdata / kapacitor

Open source framework for processing, monitoring, and alerting on time series data
MIT License
2.3k stars 492 forks source link

AlertNode .details in slack as attachment ?? #976

Open theist opened 7 years ago

theist commented 7 years ago

Enhancement.

I've been looking to the code and playing a bit with AlertNode Slack service and it seems to send only the .message to the slack as attachment "text". It would be nice to send .message as attachment "title" and .details as attachment "text".

This is because I often use the same alert node to alert several services and, to make alert informative enough in slack I need to make .message too much verbose. and the information is duplicated in .details for other services like email or an .exec endpoint I've made to integrate pushover.

igorpejic commented 7 years ago

+1 Or please explain how you can get the data that is located in details through {{ index }}?

nathanielc commented 7 years ago

@theist I like the suggestion, at this point we can't change the existing behavior of the slack integration. Is there another property like text or title that would work for details without changing the behavior of .message?

@igorpejic What data are you looking to pull out of the details? It should all be available via the index method like you say.

igorpejic commented 7 years ago

I don't know if this is very related to the issue, but since you asked me I will answer here.

Even being able to access the values in "details" won't help me, I'm afraid.

So let me explain: I am making a logging alerting system. I have logs in the influxdb database and I want to trigger alerts based on them. I have tried doing it with stream and it worked fine, but sending an alert for each log was too much for me.

Because of that I tried to make a batch alert every 10 minutes with a window of 10 minutes to check for all the logs in the database and alert on them. This is why I need all the "values" from the "series" field.

I am doing a batch query like so:

batch
    |query('''SELECT * FROM "foo"."bar".foobar''')
            .period(10m)
            .every(10m)
            .groupBy('spam')
   |alert()
           .crit(lambda: 2 > 1) 
           .log('alerts.log')

And this is the (simplified) output when I log into a file.

{
   "id":"foobar",
   "message":"...",
   "details":"{....  {log:"message1", ...}},
   "time":"2016-10-25T08:20:13Z",
   "duration":0,
   "level":"CRITICAL",
   "data":{
      "series":[
         {
            "name":"docker",
            "columns":[
               "time",
               "log"
            ],
            "values":[
               [
                  "2016-10-25T08:20:13Z",
                  "message1",
               ],
               [
                  "2016-10-25T08:20:23Z",
                  "message2",
               ]
            ]
         }
      ]
   }
}

This is a fairly reduced example, but as you can see, only the first element of the "values" list is present in the "details" field. Ideally I would like to get all these "values" and join them somehow into a single message. I want to be able to access them when I am constructing my message for example: {{ index .values }}

Thank you.

nathanielc commented 7 years ago

@igorpejic Makes sense, could you open a new issue with the above information so it can be tracked separately? Thanks

JulienChampseix commented 7 years ago

hi @nathanielc is it now possible to use .details as a attachment into slack ? If yes have you an example to use it ? I saw markdown is enable for slack attachement but didnt find example. thanks for your help

sniperaussie commented 6 years ago

Hi, Can we use anchor tag in the "details" node and include it in Slack instead of long URL strings to be displayed? Thanks