Log Alerting - Clear condition based on rolling window
Summary: Matt Whitney shared a scenario where a customer wants to keep an alert active until a specific log message is not seen for a certain number of hours. The current system allows alerts based on log conditions and keeping alerts active for a set period, but lacks a rolling timer to continuously check if the log message is still appearing. This results in alerts clearing and re-triggering based on a static window rather than on the absence of the log message. Patrick Rouse expressed appreciation for this idea and brought it to david_femino's attention.
I had a use case recently where a customer wanted to alert based off of a log message, and then keep the alert active until the log message is not seen for X amount of hours.
Currently we can alert off of a log condition and keep the alert active for X amount of hours, but there is no rolling timer to check if the log is still occurring. So once the static alert-clear window ends, the alert clears and a new one triggers the next time the log comes in.
It would be really useful if we could have an alert clear window with a rolling timer so that the alert clears if the log is not seen on the alerting device for X amount of time.
Patrick Sites
·6 months agoadded into backlog for future consideration
Patrick Rouse
·2 years agoThanks for this great idea. david_femino for awareness.