Skip to main content

Step 1: Ingest data

GIF
QS2.png
quickstartv2.gif

The first step is enabling communication between one or more of systems and APEX AIOps Incident Management so that your data is visible. Incident Management can ingest event logs and time-series metric data. You have the following three different ways to get data into Incident Management: by installing collector agents, by configuring application-specific integrations, or by setting up your own integrations using Incident Management APIs.

Option 1: Install collectors that receive data from target systems

Installing a collector is the quickest way to send data to Incident Management. Collectors are available for a variety of systems. They reside on your Linux, Windows, or MacOS systems and gather performance and health metrics, identifying metric anomalies at the source and sending metrics and anomaly-based events to Incident Management.

Option 2: Establish inbound integrations with target systems

Incident Management also includes many application-specific integrations for ingesting data from other monitoring systems. These integrations operate via webhooks or cloud-to-cloud connections. Follow these instructions to configure specific integrations:

NOTE: Setting up an inbound integration may take some time to produce data in Incident Management. Setting up a collector is the fastest way to view data.

Option 3: Set up custom integrations

You can use the Metrics and Events APIs to ingest data in JSON format that you have mapped to Incident Management fields. The Incident Management events and metrics schemas are flexible, with a small number of required fields and a large number of optional fields. The schemas include a tags field for additional information.

Finally, you can use the Create your own Integration feature to map events to Incident Management using a graphical user interface. The CYOI feature generates a custom API endpoint for your events, and walks you through the process of inspecting your data, mapping its fields to Incident Management event fields, customizing the deduplication key, and testing the results.

Checklist

Verify the following:

  • You have picked one of the three options from above and completed the data integration configuration.

  • Alerts appear on the Alerts UI (Where do I see this?).

Troubleshooting tips

Issue

Possible solution

I don't see any alerts.

Check that your integration is configured correctly. Did you only ingest metrics? If so you may need more time for Incident Management to identify anomalies.

I need additional help.

Contact APEX AIOps support

In this section:

A data object that describes an event of operational interest. An event might be based on an event notification from an external tool or a metric anomaly from a collector or Amazon CloudWatch. Events form the initial raw data for APEX AIOps Incident Management, which then deduplicates these events to form alerts.

For more information about events, see Events

A set of data points, each with its own timestamp, that measures a specific aspect of performance such as response time or utilization. Collectors can monitor performance on remote servers, detect performance anomalies locally at the source, and send anomalies and raw metrics directly to APEX AIOps Incident Management.

For more information, see Collector concepts.

An installable, Rust-based agent running on a server that does the following:

  • Observes time series metrics – either actively, at the source, or by ingesting a stream passively

  • Forwards the raw metrics to APEX AIOps Incident Management. The ingestion engine treats anomalies as performance-impacting events and aggregates them into alerts, which you can view in the Alerts page.

For more information about the APEX AIOps Incident Management Collector, see APEX AIOps Incident Management Collector.

The first observed data point after a time series metric switches from normal to anomalous performance. The ingestion engine treats each anomaly as a performance-impacting event.

deduplication key

A set of one or more unique events that all relate to a specific performance measure. APEX AIOps Incident Management deduplicates events into alerts. Then it correlates alerts into incidents.

For more information about alerts, see Events, alerts, and incidents.