sensu / sensu-go-fatigue-check-filter

An event filter for Sensu Go for managing alert fatigue
MIT License
6 stars 8 forks source link

Filter blocks every message random logs #4

Closed chukynax closed 4 years ago

chukynax commented 5 years ago
{"asset":"fatigue-check-filter","component":"asset-manager","level":"info","msg":"asset does not exist","time":"2019-09-19T20:04:43+03:00"}
{"component":"pipelined","error":"ReferenceError: 'fatigue_check' is not defined","level":"error","msg":"error executing JS","time":"2019-09-19T20:04:43+03:00"}
{"assets":["fatigue-check-filter"],"check_name":"check_disk_usage","check_namespace":"default","component":"pipelined","entity_name":"sensu","entity_namespace":"default","filter":"fatigue_check","level":"debug","msg":"denying event that does not match filter","time":"2019-09-19T20:04:43+03:00"}
{"check_name":"check_disk_usage","check_namespace":"default","component":"pipelined","entity_name":"sensu","entity_namespace":"default","filter":"fatigue_check","handler":"slack","level":"debug","msg":"denying event with custom filter","time":"2019-09-19T20:04:43+03:00"}
{"component":"pipelined","error":"ReferenceError: 'fatigue_check' is not defined","level":"error","msg":"error executing JS","time":"2019-09-19T20:04:43+03:00"}
{"assets":["fatigue-check-filter"],"check_name":"check_disk_usage","check_namespace":"default","component":"pipelined","entity_name":"sensu","entity_namespace":"default","filter":"fatigue_check","level":"debug","msg":"denying event that does not match filter","time":"2019-09-19T20:04:43+03:00"}
{"check_name":"check_disk_usage","check_namespace":"default","component":"pipelined","entity_name":"sensu","entity_namespace":"default","handler":"alerta","level":"info","msg":"event filtered","time":"2019-09-19T20:04:43+03:00"}

everything was set up according to examples

nixwiz commented 5 years ago

Hi @chukynax, can you post your exact entries for the asset, filter, and handler?

chukynax commented 5 years ago
---
type: Asset
api_version: core/v2
metadata:
  name: sensu-go-fatigue-check-filter_any_noarch
  labels: 
  annotations:
    io.sensu.bonsai.url: https://bonsai.sensu.io/assets/nixwiz/sensu-go-fatigue-check-filter
    io.sensu.bonsai.api_url: https://bonsai.sensu.io/api/v1/assets/nixwiz/sensu-go-fatigue-check-filter
    io.sensu.bonsai.tier: Community
    io.sensu.bonsai.version: 0.2.1
    io.sensu.bonsai.namespace: nixwiz
    io.sensu.bonsai.name: sensu-go-fatigue-check-filter
    io.sensu.bonsai.tags: eventfilter
spec:
  url: https://assets.bonsai.sensu.io/82dc07cb79697eb041f731f9de748c4320aec07a/sensu-go-fatigue-check-filter_0.2.1.tar.gz
  sha512: 7fd5343fc1feee9277d012221df90412ab5e30287e8bf9b0fd94475f59997baec96b37412522fe3291f1fba64dd3cb9c1ffe3248a261ea72b984342a88bae10c
  filters: []
{
  "type": "EventFilter",
  "api_version": "core/v2",
  "metadata": {
    "name": "fatigue_check",
    "namespace": "default"
  },
  "spec": {
    "action": "allow",
    "expressions": [
      "fatigue_check(event)"
    ],
    "runtime_assets": [
      "fatigue-check-filter"
    ]
  }
}
type: CheckConfig
api_version: core/v2
metadata:
  name: check_disk_usage
  namespace: default
  annotations:
    fatigue_check/occurrences: "3"
    fatigue_check/interval: "3600"
    fatigue_check/allow_resolution: "false"
spec:
  command: check-disk-usage.rb -w 80 -c 90
  handlers:
  - slack
  - alerta
  interval: 60
  publish: true
  round_robin: true
  subscriptions:
  - system

type: Handler
api_version: core/v2
metadata:
  name: slack
  namespace: default
spec:
  command: sensu-slack-handler --channel '#monitoring' -w https://hooks.slack.com/services/<hash>
  filters:
  - is_incident
  - fatigue_check
  handlers: null
  timeout: 0
  type: pipe
nixwiz commented 5 years ago

You reference the "runtime_asset" for the filter as "fatigue-check-filter", but it doesn't appear that the asset is named that way. It's named "sensu-go-fatigue-check-filter_any_noarch" per the snippet below. Make sure that the names line up so that the asset will be downloaded.

---
type: Asset
api_version: core/v2
metadata:
  name: sensu-go-fatigue-check-filter_any_noarch

That would account for this error (the first one you listed):

{
  "asset": "fatigue-check-filter",
  "component": "asset-manager",
  "level": "info",
  "msg": "asset does not exist",
  "time": "2019-09-19T20:04:43+03:00"
}
nixwiz commented 4 years ago

Closing due to no further response.