Post alerts to a Slack channel

Publish ilert alerts into a Slack channel and accept, reroute, and resolve them there, without opening ilert.

Connect your Slack workspace first

An Admin or Account owner connects the workspace once, as described in the Slack integration guide. Creating the alert action below needs no admin role.

Alerts reach Slack through an alert action: a rule that publishes the alerts of one or more alert sources to one channel. Create one alert action per channel.

Create a Slack alert action

1

Start a new alert action

In the sidebar, go to Alerting → Alert actions and click Create new alert action.

You can also start from the alert source: open it, go to its Alert actions tab, and click Create new alert action there. The source is filled in for you.

2

Choose Slack

Select the Slack tile and leave Use webhook unticked — the webhook variant posts plain messages without the buttons. Click Next.

Pick Slack, and leave Use webhook unticked to get interactive alert messages.

3

Choose the alert sources and the events to publish

Select the alert sources whose alerts should reach the channel. Leave Trigger mode on Automatic; Slack alert actions cannot be triggered by hand.

Under Trigger events, only Alert created is ticked. Add at least Alert accepted and Alert resolved — see which events to pick. Click Next.

A new alert action publishes Alert created and nothing else until you add more events.

4

Skip the conditions

Conditional execution narrows an alert action to alerts that meet conditions you set, for example a priority or a label. Click Next to publish every alert of the chosen sources.

5

Name it and choose the channel

Give the alert action a name and pick the Channel. The list holds the channels you are a member of; if it is empty, see the FAQ.

Assign the alert action to teams decides which teams manage it, and appears only when your account has teams. Click Save.

The channel field is a typeahead over the channels you have joined.

6

Save again

Save opens the alert action's edit page, where you can change anything you just entered. Click Save there to reach its detail page.

7

Test it

Click Test in the top right. A test alert appears in the channel within a few seconds, and ilert shows Test successful!

The detail page summarizes what is published, and where.

The test message is a stand-alone message with no buttons: it carries the summary "Test Alert", the escalation policy "Default", and a low priority, whichever alert sources and events you chose. Each test posts a new message. Real alerts arrive with buttons.

The test message confirms the connection.

What the message looks like

The card carries the alert's status and summary as a link into ilert, its details, and the fields that matter while you triage: Escalation policy, Priority, up to five Labels, Responders, Links, and Affected services. Images attached to the alert are shown. The colored bar is red while the alert is pending, yellow once accepted, and green when resolved.

Times are rendered by Slack in each reader's own time zone. The card is written in German when the channel's locale is German, and in English otherwise.

The buttons

Button	What it does
Accept	Takes ownership of the alert, which stops the escalation
Reroute	Assigns the alert to a different escalation policy, chosen in a dialog
Resolve	Closes the alert
More actions → Raise priority	Raises a low-priority alert to high
More actions → Add responder	Adds a user, or the person currently on call in a schedule
More actions → Escalate	Moves the alert to a chosen level of its escalation policy
More actions → Merge into another alert	Merges this alert into another open alert
More actions → Add comment	Writes a comment on the alert
More actions → Add affected services	Links services to the alert
More actions → Create incident	Publishes a status update about the alert
More actions → alert action name	Runs a manual alert action of that alert source

Once an alert is resolved, the buttons that would change it are gone — accept, reroute, resolve, escalate, add responder, raise priority — and More actions keeps merge, comment, and the incident-communication items. An alert that was merged into another shows a link to the main alert instead.

Accept and Resolve work for everyone in the channel, including people without an ilert account. Every other button needs an ilert user whose username or email address matches the email address on the Slack account; otherwise the person gets a private message naming the address ilert does not know.

Choose which events reach Slack

The Trigger events you tick decide two things: when the card is updated, and which short notes are posted as replies in its thread. An event you leave unticked leaves the card alone — including when the change was made from Slack itself: press Accept in the channel with Alert accepted unticked and ilert accepts the alert, but the card still reads [PENDING].

Trigger event	What happens in the channel
Alert created	The card is posted
Alert accepted	The card turns yellow; the thread reads "Name accepted the alert"
Alert re-routed	The thread names the new escalation policy, level, or assignee
Alert escalated	The thread reads "Alert assigned to Name"
Alert priority raised	The thread reads "Alert priority raised"
Alert resolved	The card turns green and loses its buttons
Alert comment added	The comment is posted in the thread
Responder added to alert, Responder removed from alert	The thread names who changed
Channel attached to alert, Channel detached from alert	The card gains or loses a link to the alert's own channel
… after alert has reached end of escalation policy and is still pending	The thread reads "Alert reached end of escalation policy and is still pending", immediately or after the delay you choose
Alert is not resolved within …	The thread reads "Alert is still not resolved"

With only Alert created ticked, the card is not updated as the alert moves on. Somebody presses Accept in Slack, the alert is accepted in ilert, and the message still reads [PENDING]. Tick at least Alert accepted and Alert resolved.

Some things reach Slack whatever you tick. Three event types skip the filter entirely: the alert is merged into another alert, another alert is merged into it, and a log is attached to it. Pressing a button in Slack also posts a short reply in the thread naming who pressed it, whether or not the matching event is ticked. And the first event to arrive after an alert action is created posts the card.

When more than ten minutes have passed since ilert last updated this card, the next thread note is also shown in the channel, so a long-running alert does not go unnoticed. Replies from people do not reset that clock.

To change the events later, open the alert action and click Edit.

Comments from Slack

Replying in the card's thread writes the reply to the alert as a comment, where it appears under the alert's Comments tab marked as coming from Slack. Mentions are rendered as names, and emoji are kept.

For that to work, two things have to be true. The ilert bot has to be a member of the channel: Slack delivers message events only for channels an app has been added to, so a public channel the bot posts to without having joined shows cards but syncs no replies. Invite it by mentioning @ilert in the channel and sending the message, then clicking Add Them. And the person replying needs an ilert user whose username or email address matches their Slack email address; replies from anyone else are dropped without a message. Edits, deletions, reactions, and messages posted outside the thread are never synced.

Comments written in ilert reach the thread only if Alert comment added is one of the alert action's trigger events.

FAQ

Are updates to an alert published in Slack?

Yes, for the trigger events you tick. See Choose which events reach Slack.

Can I publish alerts from several alert sources to one channel?

Yes. One alert action can carry up to 49 alert sources. Each alert gets its own card, and each alert action keeps its own card for an alert — two alert actions posting to two channels means two cards.

Why am I not seeing my Slack channels in the ilert UI?

Three things have to be true before a channel appears in the dropdown.

First, your ilert account email must match your Slack account email. ilert enforces Slack's own channel permissions, and it uses the email address to work out who you are in Slack. If they differ, the dropdown stays empty.

Where the two addresses cannot be kept in sync, an Admin or Account owner still gets a list: ilert then offers every channel the ilert bot can see. Other roles see an empty list and have to ask an administrator. Keeping the addresses in sync is the better option — then Slack's channel permissions apply to every role, administrators included.

Second, you must be a member of the channel at the time you create the alert action. You can leave afterwards. In practice this means the channel has to appear under Channels in your Slack sidebar.

The channel has to be one you have joined.

Third, public channels appear immediately, but private ones do not. Invite the ilert bot to a private channel — after joining it yourself — by mentioning @ilert and sending the message.

Mention the bot and send the message.

Slack then offers to add the bot.

Click Add Them.

Confirmation that the bot has joined.

Back in the alert action, search again or reload the page. The channel now appears.

Still not there? The list holds 150 channels at a time, and typing filters it by the beginning of the channel name — "payments" finds #payments-alerts, "alerts" does not. Type the first word of the name.

Nothing arrives in the channel. Where do I look?

Open the alert action and read Alert action logs at the bottom of its detail page: recent deliveries are listed with their status, and a failed one carries Slack's error message. A failure is also written to the alert's timeline. The usual causes are a private channel the bot was never invited to, and a channel that was archived or deleted in Slack.