Master Alert Selector

Filters are applied before any sorting is performed. You can choose to include or exclude alerts that match the filter.

For example, to exclude cleared alerts from the calculation, configure the filter clause as severity == 0 and select the Exclude alerts matching the filter option.

Minimum and maximum criteria are applied in the order they are defined, and the order can affect the results. After each criterion is evaluated, the results are checked. If a master alert is found, no further sorting is performed.

Each criterion acts as a tie-breaker for the preceding criterion.

For example, consider the following criteria:

And the following alerts (truncated for clarity):

[
  { 
    alert_id : 1 
    severity : 5
    first_event_time : ...31
  },
  { 
    alert_id : 2 
    severity : 4
    first_event_time : ...32
  },
  { 
    alert_id : 3 
    severity : 5
    first_event_time : ...33
  }
]

The sort order is "highest severity, followed by lowest first_event_time".

After sorting by severity, the remaining results are as follows:

[
  { 
    alert_id : 1 
    severity : 5
    first_event_time : ...31
  },
  { 
    alert_id : 3 
    severity : 5
    first_event_time : ...33
  },
  { 
    alert_id : 2 
    severity : 4
    first_event_time : ...33
  }
]

Alerts 1 and 3 have a severity of 5, while Alert 2 has a severity of 4.

Because a single master alert has not yet been identified, the next criterion (lowest first_event_time) is applied to break the tie between Alerts 1 and 3.

After applying this sort, the results are as follows. Since Alert 1 has a unique first_event_time value, it is selected as the master alert.

[
  { 
    alert_id : 1 
    severity : 5
    first_event_time : ...31
  },
  { 
    alert_id : 3 
    severity : 5
    first_event_time : ...33
  }
]

If no single master alert is identified after all criteria have been evaluated, alert_id is used as the final tie-breaker. The alert with the lowest alert_id is selected as the master alert.

Using the same alerts, but including count and changing the criterion order, produces a different result.

Criteria:

[
  { 
    alert_id : 1 
    severity : 5
    count : 1
    first_event_time : ...31
  },
  { 
    alert_id : 2 
    severity : 4
    count : 3
    first_event_time : ...32
  },
  { 
    alert_id : 3 
    severity : 5
    count : 2
    first_event_time : ...33
  }
]

After sorting by count, Alert 2 is selected as the master alert because it has the highest count and that value is unique. No further evaluation of severity or first_event_time is required, as a master alert has already been identified.