OpenObserve Integration

Create alerts in ilert from OpenObserve alerts — with ilert's OpenObserve inbound integration.

OpenObserve is an open-source observability platform for logs, metrics, traces, and RUM. Its alerting engine lets you define scheduled and real-time alerts on your streams and deliver them to notification destinations. With this integration, alerts raised in OpenObserve automatically create alerts in ilert, so the right responders are notified and escalations happen reliably.

In ilert: Create an OpenObserve alert source

Go to Alert sources --> Alert sources and click on Create new alert source
Search for OpenObserve in the search field, click on the tile and click on Next.
Give your alert source a name, optionally assign teams and click Next.
Select an escalation policy by creating a new one or assigning an existing one.
Select your Alert grouping preference and click Continue setup. You may click Do not group alerts for now and change it later.
The next page shows additional settings such as custom alert templates or notification priority. Click on Finish setup for now.
On the final page, ilert generates a webhook URL for your alert source. Copy it — you will need it in the next section.

In OpenObserve: Create a template

A template defines the payload that OpenObserve posts to ilert.

Click on Management in the left navigation.
In the sidebar, click on Templates.
Click on New template.
Give the template a name, for example ilert_template, keep Web Hook selected, copy and paste the template below into the Body field, and click Save.

Payload template

{
  "org_name": "{org_name}",
  "stream_type": "{stream_type}",
  "stream_name": "{stream_name}",
  "alert_name": "{alert_name}",
  "alert_type": "{alert_type}",
  "alert_period": "{alert_period}",
  "alert_operator": "{alert_operator}",
  "alert_threshold": "{alert_threshold}",
  "alert_count": "{alert_count}",
  "alert_agg_value": "{alert_agg_value}",
  "alert_start_time": "{alert_start_time}",
  "alert_end_time": "{alert_end_time}",
  "alert_url": "{alert_url}",
  "alert_trigger_time": "{alert_trigger_time}",
  "alert_trigger_time_millis": "{alert_trigger_time_millis}",
  "alert_trigger_time_seconds": "{alert_trigger_time_seconds}",
  "alert_trigger_time_str": "{alert_trigger_time_str}"
}

All fields of the alerted stream are available as variables too. The Template Variable Guide on the right side of the template editor lists every variable you can use, so you can enrich the payload with your own fields — they show up as custom details on the ilert alert.

In OpenObserve: Create a notification destination

Still in Management, click on Notification Destinations and select Custom Destination.
Click on New destination.
Choose Custom Destination as the destination type.
Keep Web Hook selected and fill in the fields:
- Name: a name for the destination, for example ilert_webhook
- Template: the template you created in the previous section, for example ilert_template
- URL: the webhook URL you copied from your ilert alert source
- Method: post
Then click Save.

In OpenObserve: Use the destination in an alert

The destination now appears in the list. Click on Alerts in the left navigation.
Create a New alert, or edit an existing one, and select the destination you created as its notification destination.
Save the alert. You are done.

When the alert's condition is met, OpenObserve renders the template and posts it to ilert, which creates an alert.

FAQ

Will alerts in ilert be resolved automatically?

No. OpenObserve notifies its destinations while an alert condition is satisfied, but it does not send a separate recovery event. The ilert alert therefore stays open until it is resolved in ilert.

PreviousopenITCOCKPIT Integration NextOpenSearch Integration

Last updated 11 days ago

Was this helpful?