search

johnsusek / praeco

Elasticsearch alerting made simple.
GNU General Public License v3.0
546 stars 87 forks source link

Praeco is sending too many emails for each alert once it is triggered #189

Open suresh447 opened 4 years ago

suresh447 commented 4 years ago

Hi All,

I am facing issue like praeco server is sending too many emails once the alert is triggered.

Please find the alert condition which i setup in the server

WHEN countOVER all documentsWITH FILTER log:error AND kubernetes.namespace_name:intelligenttraveller AND stream:stdoutIS ABOVE 1 FOR THE LAST 5 minutes WITH OPTIONS

Aggregation

Instead of sending alerts immediately, send a report of alerts on a schedule. Schedule Every 30th minute past every hour Schedule is in the server's time zone. Summary table kubernetes.pod_name kubernetes.namespace_name log stream Include a summary table of these fields in alert.

For this alert i received 700+ emails.

daichi703n commented 4 years ago

Which did you select on Include? image

Aggregation summary only summarize the alert. (Result of previous version. Latest version not yet tested... Please let me know how it works.)

suresh447 commented 4 years ago

@daichi703n Now its fine i got only one alert with Aggregation summary only option in include option.

daichi703n commented 4 years ago

👍

johnsusek commented 4 years ago

I will have to update the UI to only allow aggregation summary type of "Include" when aggregation is enabled..