How to set Alert Severity from an Event Rule in Event Management?

edvarda_e
Kilo Contributor

‎04-05-2017 06:25 AM

Hello!

I am building an application that receives temperature measurements over time from a chip in a freezer through REST API (no external source tool to generate events). My goal is to create Incidents whenever the temperature is above a certain threshold four times within a predefined timeperiod.

My current apporach to achieveing this is as follows:

  • A business rule that has a Condition with the preset temperature threshold. If the temperature is above the limit it creates an Event in the em_event table, with a CI (the chip).
  • Then I have a Event Rule that tracks how many events are made containing temperture (as a Threshold metric with the Threshold functionality) within a certain time period, and if it is two it creates an Alert bound to the CI.
  • Now I'm trying to create a similar Event Rule that counts up to four instead, within a slightly longer time period, and if it comes to that I want to make an Alert that has the Severity "Critical".
  • (This is so that I later on can make an Alert Rule that generates Incidents based on Incident templates whenever it finds an Alert from said CI with Severity == Critical).

I am trying to set the Severity field of the Alert by using the Event Compose Fields, but no matter how I format the input it only adds it under "Additional Information" in the Alert, instead of changing the Severity field. So, my question is as the title suggests, how do I set Alert Severity from an Event Rule in Event Management?

Hope that someone can help me with this!

Labels:
0 Helpfuls
  • 2,314 Views
2 REPLIES 2

angeliccharm
Giga Expert

‎04-12-2017 12:37 PM

Hi Edvarda,



Pleasure to "meet" you. This may seem like a simple response, but here goes... add the severity to the event itself. It will transfer up to the alert.



edvarda_e
Kilo Contributor
In response to angeliccharm

‎04-13-2017 12:45 AM

Hi Lisa!



Pleasure to "meet" you aswell and thank you so much for your repsonse!


I figured out the format in the end, as it turned out I had somehow missed the most elementary format, namely Field: severity, Compisition: 1 in the Event Compose Field. (I had been trying stuff like ${severity}) So that works aswell.



But maybe your way is better practice?



Best regards,
Edvarda Eriksen


0 Helpfuls