How to set Alert Severity from an Event Rule in Event Management?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎04-05-2017 06:25 AM
Hello!
I am building an application that receives temperature measurements over time from a chip in a freezer through REST API (no external source tool to generate events). My goal is to create Incidents whenever the temperature is above a certain threshold four times within a predefined timeperiod.
My current apporach to achieveing this is as follows:
- A business rule that has a Condition with the preset temperature threshold. If the temperature is above the limit it creates an Event in the em_event table, with a CI (the chip).
- Then I have a Event Rule that tracks how many events are made containing temperture (as a Threshold metric with the Threshold functionality) within a certain time period, and if it is two it creates an Alert bound to the CI.
- Now I'm trying to create a similar Event Rule that counts up to four instead, within a slightly longer time period, and if it comes to that I want to make an Alert that has the Severity "Critical".
- (This is so that I later on can make an Alert Rule that generates Incidents based on Incident templates whenever it finds an Alert from said CI with Severity == Critical).
I am trying to set the Severity field of the Alert by using the Event Compose Fields, but no matter how I format the input it only adds it under "Additional Information" in the Alert, instead of changing the Severity field. So, my question is as the title suggests, how do I set Alert Severity from an Event Rule in Event Management?
Hope that someone can help me with this!
- Labels:
-
Event Management
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎04-12-2017 12:37 PM
Hi Edvarda,
Pleasure to "meet" you. This may seem like a simple response, but here goes... add the severity to the event itself. It will transfer up to the alert.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎04-13-2017 12:45 AM
Hi Lisa!
Pleasure to "meet" you aswell and thank you so much for your repsonse!
I figured out the format in the end, as it turned out I had somehow missed the most elementary format, namely Field: severity, Compisition: 1 in the Event Compose Field. (I had been trying stuff like ${severity}) So that works aswell.
But maybe your way is better practice?
Best regards,
Edvarda Eriksen