Working with alerts

Filter the alert list down to what you care about, save those views, and act on alerts in bulk.

The Alerts page is where triage happens. On a busy account it lists far more than any one person needs, so most of the work is narrowing it — by label, by source, by status — and then acting on what is left.

Filter alerts by labels

Labels come from the events your tools send. Filtering on them narrows the list to a service, an environment, or a cluster.

1

Open the label filter

Go to Alerts, then click Filter under the Labels header.

2

Choose a key, an operator, and a value

In Add label filter, pick the label key (for example app), choose an operator such as is equal to, then select or type the value (for example database).

3

Add it

Click Add filter. Repeat to narrow further — multiple label filters apply together.

Save a view

A filter you rebuild every morning should be a saved view instead.

1

Save the current filters

With your filters applied, click the + icon in the Saved filters bar.

2

Name it and choose who sees it

Enter a name, then pick a visibility:

Visibility	Who sees it
Personal	Only you
Team	Members of the teams you select
Public	Everyone in the account

3

Save

Click Save. The view appears as its own tab in the Saved filters bar.

Managing a saved view

Click the three-dot icon on a saved filter tab:

Action	Does
Edit	Change the name or visibility
Copy link	Share a direct link to this filtered view
Duplicate	Copy it as a starting point for another view
Pin filter	Make it the view you land on when opening Alerts
Delete	Remove it permanently

Act on alerts in bulk

During a noisy period, handling alerts one at a time is the bottleneck. Select several and act on them together.

Tick the checkboxes on the left of each row — or the checkbox in the header row to select everything in the current filtered view — and a bulk action bar appears above the list.

Action	Does
Accept	Take ownership. This stops escalation on every selected alert.
Reroute	Move the selected alerts to a different escalation policy
Resolve	Close them, if the underlying problem is fixed
Link incident	Attach them to an existing incident
Merge	Combine them into one parent alert — see Merging alerts

An alert that is already a parent — one that has other alerts merged into it — cannot be merged into another alert.

Bulk Accept halts escalation on everything you selected. If you are clearing a backlog rather than taking ownership, Resolve is usually what you want.