Unable to get Kapacitor alert details property in Alerta

[Randy_Wolfgram]

We are in the process of implementing TICK as a replacement for our current monitoring platform and still getting our feet wet, so bare with me
We are going to leverage Alerta as our event console so we will send any Kapacitor alerts there for distribution and everything works fine with the integration unless I try to expose the details property to Alerta. We populate that property in the alert with an internal URL that has run book info in it for the on-call engineer to reference as part of our incident management process so would prefer to have this flow into Alerta, but when I configure it that way, I am getting the following in the kapacitor log

ts=2019-01-07T22:35:04.328Z lvl=error msg="failed to evaluate Alerta template" service=alerta handler=alerta topic=services err="template: value:1:3: executing \"value\" at <.Details>: can't evaluate field Details in type alert.TemplateData" value="{{ .Details }}"

The config for our topic handler for alerta looks like this:

topic: services id: alerta kind: alerta options: resource: '{{ .Name }}' event: '{{ .ID }}' environment: '{{ index .Tags "env"}}' group: '{{ .Group }}' origin: 'kapacitor' value: '{{ .Details }}' service: ['Pinger Service']

A typical alert looks like this

`var limit = 1
var escalations = 2

dbrp “telegraf”.“autogen”

var data = stream
|from()
.measurement(‘abuse’)
|window()
.period(30s)
.every(30s)
|mean(‘hard_block’)
.as(‘blocks’)
|derivative(‘blocks’)
.nonNegative()
.unit(1s)
.as(‘blocked_rate’)
|stateCount(lambda: “blocked_rate” > limit)
.as(‘count’)
|log()

data
|alert()
.stateChangesOnly()
.id(‘Too many hard blocked accounts’)
.message(‘{{ .Level }} alert: {{ .ID }}: current value {{ index .Fields “blocked_rate” | printf “%0.2f” }}’)
.details(‘’‘http://redactedDomainNameHere/display/Ops/Alerts#Alerts-Toomanyhardblockedaccounts’‘’)
.crit(lambda: “count” > escalations)
.topic(‘services’)
`
If I change the topic handler to pass in something like {{ .ID }} or {{ .Message }} as the value option it works, so not sure what I’m doing wrong or if I’m just misunderstanding whether or not it’s possible to pass in the details property to Alerta.

We are running the following versions:
InfluxDB - 1.7.1 (OSS)
Kapacitor - 1.5.1

Any help would be greatly appreciated

[michael]

Hey @Randy_Wolfgram

I’m tryin to understand this issue a bit more. I’m struggling to match up errors with tickscripts. Would it be possible for you to provided the tickscript and the associated error, for each of the things you’ve tried. With notes of exactly which things worked and which did not.

[Randy_Wolfgram]

Hi @michael, thanks for taking a quick look at this. I can probably make this a bit more clear. The requirement I’m trying to meet is to have the contents of the details property of the alert show up in Alerta.

I think this issue is more with the alerta handler. If I configure the handler like this:

topic: services
id: alerta
kind: alerta
options:
resource: ‘{{ .Name }}’
event: ‘{{ .ID }}’
environment: ‘{{ index .Tags “env”}}’
group: ‘{{ .Group }}’
origin: ‘kapacitor’
value: '{{ .Details }}'
service: [‘Pinger Service’]

I get the error the following error in the kapacitor logs and the alert doesn’t make it to Alerta:

ts=2019-01-07T22:35:04.328Z lvl=error msg=“failed to evaluate Alerta template” service=alerta handler=alerta topic=services err=“template: value:1:3: executing “value” at <.Details>: can’t evaluate field Details in type alert.TemplateData” value="{{ .Details }}"

If I configure the handler something like this:

topic: services
id: alerta
kind: alerta
options:
resource: ‘{{ .Name }}’
event: ‘{{ .ID }}’
environment: ‘{{ index .Tags “env”}}’
group: ‘{{ .Group }}’
origin: ‘kapacitor’
value: '{{ .Message }}'
service: [‘Pinger Service’]

I don’t get error and the alert shows up in Alerta, but that doesn’t meet the requirement as the content that I need is in the details property. If it’s not possible to access the contents of the details property in the handler, then I just need to know that.

Thanks!