# Automatically resolve Alerts with Emails

In this Email integration guide, you’ll learn how to configure ilert to automatically resolve incidents through incoming email triggers. This reduces manual intervention, improves incident hygiene, and enables more efficient closure workflows based on pre-defined signals.

## Alert Key extraction configuration

For this example we will demonstrate the alert key / identifier extraction based on a UUID version 4. We will use the following regex to extract the alert key from the subject of the incoming emails:

`[a-f0-9]{8}-[a-f0-9]{4}-4[a-f0-9]{3}-[89aAbB][a-f0-9]{3}-[a-f0-9]{12}`

When selecting the **subject** field, the extraction through regex is done by using the function **extractRegex()** from the [ITL](broken://pages/WvTAbPqPXVB6kdEsfoQH). This will cut out the text that is matched by the provided regex from the incoming email subject. We can simply pass the regex into the input field.

<figure><img src="/files/HOXiJGCdg6YzqzpP3YS2" alt=""><figcaption></figcaption></figure>

Every incoming email with now extract the alert key based on the provided regex. Providing a sample payload leads to the desired extraction.

<div><figure><img src="/files/rXj4m8jbCwOisShEm59Q" alt=""><figcaption></figcaption></figure> <figure><img src="/files/G0NWIuUzdTYgDGD6oFtm" alt=""><figcaption></figcaption></figure></div>

In case that no match for the regex is found, the email is dropped. In case that there is already an open alert for the extracted alert key, the email will not create a new alert, instead it will be attached to the existing alert. In case the email resolve filter (see below) will match and there is no open alert for the alert key, the email will also be dropped.

## Alert resolution

Now that we have configured our alert key extraction, we can set up our automatic email resolve filter. To enable the conditions we have to tick the checkbox for the resolve alert rule.

<figure><img src="/files/mkFH8DGqXP7mnGAZPg9s" alt=""><figcaption></figcaption></figure>

We are now able to configure as much conditions at we like (note that you can swap between applying **ALL** conditions **OR** single one of them, just like the accept filter).

In our example case we choose to scan the incoming email subjects for the text `resolve me` in case it is found and the alert key could be extracted (and an open alert for the same key exists) the incoming email will cause the alert to be resolved.

<figure><img src="/files/8Uvl5XdePHOczOcUklZV" alt=""><figcaption></figcaption></figure>

## Debugging Emails

In case your email alert source is not resolving as you would expect, you can always check the [alert source logs](/alerting/configure-alerting/alert-sources.md#alert-source-logs) to see how and why incoming emails where treated.

<figure><img src="/files/S08hMYreBi1Y4bbvUwyJ" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.ilert.com/integrations/inbound-integrations/email/automatically-resolve-incidents-with-emails.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.