Alert attributes and metadata

Overview

Alert attributes and metadata provide rich contextual information that extends beyond the basic alert properties. These additional data points help users understand the alert's context, facilitate more precise filtering, and enable better decision-making.

Core metadata fields

In addition to the fundamental alert properties (id, status, severity), ToBeAlert alerts include several important metadata fields:

Field	Description
createTime	Timestamp when the alert was first created
lastReceiveTime	Timestamp when the alert was last updated
resource	The specific resource affected by the alert
service	Services related to or affected by the alert
group	Organizational group the alert belongs to
environment	The environment where the alert originated (e.g., production, staging)
event	The type of event that triggered the alert

Custom attributes

The attributes field is a flexible key-value object that can contain any number of custom properties specific to the alert. These attributes:

• Are stored as an object with string keys and values
• Can be used for detailed filtering
• Provide additional context about the alert
• May contain system-specific or application-specific information

Example attributes

"attributes": {
  "region": "us-west-2",
  "instance_id": "i-1234567890abcdef0",
  "cpu_usage": "95.2%",
  "memory_free": "256MB",
  "disk_space": "98%",
  "error_code": "HTTP_503",
  "customer_id": "cust_12345",
  "component": "database"
}

Filtering by attributes

ToBeAlert provides powerful filtering capabilities for attributes:

• Filter by attribute existence (has a specific attribute key)
• Filter by attribute values using various operators:
  • Equals (eq)
  • Not equals (neq)
  • Contains (contains)
  • Not contains (not_contains)
  • Greater than (gt) for numeric values
  • Less than (lt) for numeric values
  • Includes (includes) for array values
  • Not includes (not_includes) for array values

Example attribute filters

• Find all alerts with CPU usage greater than 90%
• Find all alerts from a specific customer
• Find all alerts with a specific error code
• Find all alerts in a particular region

Data types and special handling

ToBeAlert recognizes different types of attributes and provides specialized handling:

Type	Description	Example
base	Standard string or numeric values	"region": "us-west"
date	Date/time values	"maintenance_window": "2025-04-15T14:00:00Z"
array	Array of values	"affected_servers": ["web-01", "web-02"]
tagged	Values with tags	"status": "degraded#critical"
arrayTagged	Arrays with tagged values	"components": ["database#critical", "cache#warning"]

Working with alert attributes

In the UI

The ToBeAlert interface provides several ways to work with attributes:

1. Table view: Configure columns to display specific attributes
2. Filtering panel: Create complex filters based on attributes
3. Details drawer: View all attributes for a specific alert
4. Custom views: Save filtered views based on attribute combinations

Best practices

For effective use of alert attributes:

1. Standardize attribute names across your monitoring systems
2. Use consistent formats for attribute values
3. Create custom filters for frequently used attribute combinations
4. Document the meaning of custom attributes for your team
5. Use attributes for automation through the API

Extending alert attributes

The flexible nature of the attributes system allows for continuous extension:

• Add new attributes as your monitoring needs evolve
• Integrate with external systems by mapping their data to attributes
• Create custom views based on specific attribute combinations

By effectively utilizing alert attributes, you can gain deeper insights into your alerts, create more precise filtering rules, and improve your team's ability to respond to issues quickly and effectively.