OpsGenie: closing alerts automatically

[sergioasantiago]

I would like to follow up on the topic mentioned in the issue #1560 from the original elastalert repository.

Is there any way to achieve that in elastalert2?

[nsano-rururu]

I'm not sure because I don't use OpsGenie, but if you want to tackle the problem, do it. You don't have to get permission from anyone.

[sergioasantiago]

Thanks for your answer. It is not about asking for permission but rather checking whether it is already implemented.

I'm just wondering if there is already out-of-the-box a way to send resolve alerts from elastalert, whenever the rule is not triggering anymore.

[nsano-rururu]

Not implemented. You can see the source code, so look at that much.
https://elastalert2.readthedocs.io/en/latest/ruletypes.html#opsgenie
https://github.com/jertel/elastalert2/blob/master/elastalert/alerters/opsgenie.py

[nsano-rururu]

In the first place, elastalert2 does not have a function like the resolution notification you are talking about, because it alerts you to the ones that are in violation of the rules.

[jertel]

Could you create a second "resolve" rule, with an address override such as opsgenie_addr: https://api.opsgenie.com/v2/alerts/close/myalias/close?identifierType=alias, and then for the rule to trigger, use a flatline rule type that detects when the alerting rule ceases to match, as discussed in #115?

[sergioasantiago]

Thanks for your reply, I think that solves the issue.

[albertoCrego]

@jertel I want to try this solution because we have several alerts that stop firing but the tickets keep open until someone closes it manually.
But I don't understand how to do it:

• Rule A > Generate one alert with the alias XXX
• Rule B (flatline) detect that rule A stops firing. This rule has a different opsgenie_addr with a close API request but this one should be dynamically created: https://api.opsgenie.com/v2/alerts/close/<alias-ruleA-xxxx>/close?identifierType=alias

How it's possible to connect the alias from RuleA with RuleB?

[vitalinoborges]

Thank you, @jertel for your excelent contribution!

Instead of uses the following OpsGenie URL endpoint to close alerts:

https://api.opsgenie.com/v2/alerts/<ALIAS NAME HERE>/close?identifierType=alias

Example:

name: Service is back online
type: flatline
index: elastalert_status*
query_key: "rule_name"
filter:
- query:
    query_string:
      query: "rule_name:\"RULE_NAME_HERE\" AND matches:>0"
forget_keys: true
timeframe:
  minutes: 10
threshold: 1
alert:
- "opsgenie"
opsgenie:
opsgenie_addr: https://api.opsgenie.com/v2/alerts/<ALIAS NAME HERE>/close?identifierType=alias
opsgenie_key: ${OPSGENIE_API_KEY}