Customized alert reports
Description
A Flow that pulls an alert count from 2 different time periods, combines and transforms it into a specific format, and sends a report with the results via email to the required recipients.
This Flow checks the number of alerts triggered in the last hour and compares them with the alerts received over the same day and hour of the previous week. The info comparing both alert counts is sent via email every x minutes.Â
To get this, the Flow is made up of 2 different branches:
The top branch counts the alerts triggered over the last hour.
The bottom branch counts the alerts triggered over the same hour, seven days previously.
In Flows with different branches like this one, note that branches are always executed in a specific sequential order. You can check the order by hovering over the links that go out from a specific port and checking the number that appears. In this specific Flow, we need the top branch to be executed before the other one.
To change the execution order, click a link, select the arrows icon that appears and click the top or bottom arrow button to set the order of that link higher or lower. Learn more about this in Working with links.
Flow configuration
The following table describes the units needed to create this Flow, as well as how to configure and link them.
Unit type and description | Configuration |
---|---|
Generator This unit will fire an event every x minutes (in this example, every minute). We will enrich these events using the following units and will use them to activate the required queries. | Drag a Generator unit to the canvas and open its configuration options by double-clicking it. On the General tab, add a Name to the unit (in this example, we called it Clock), and specify the Time field name that will contain the output event times (in this example, eventdate). Then, on the Period tab, enter 60000 in the Millis field. Also, switch on the Exact, Aligned, and Drop past periods toggles. Click Apply to save the configuration. |
Map We will use a couple of Map units to enrich the events with time information. As said above, we will be comparing alerts triggered the last hour with alerts triggered over the same day and hour of the previous week. To do it, we will use these Map units to specify the start and end date of each period. | Drag 2 Map units to the canvas and link their in ports to the out port of the Generator unit. As mentioned in the introduction of this article, Flows follow a sequential order. In this case, we want the top branch of the Flow to activate before the bottom want. To do this, you must first link the Generator unit to the top Map (prepareQueryTimeInterval), and then to the bottom one (preparePastQuertTimeInterval). As said above, you can always change the execution order by clicking a link, selecting the arrows icon that appears, and clicking the top or bottom arrow button to set the order of that link higher or lower. Learn more about this in Working with links. Now follow the steps below to configure both units:
Then, on the Fields to add tab, you must add 3 different fields by clicking the + icon:
|
Devo Full Query We will use a couple of Devo Full Query units to specify the query that defines the alerts to be compared. We will be querying the | Drag 2 Devo Full Query units to the canvas and link their in ports to the out ports of the Map units, as follows: Now follow the steps below to configure both units:
Then, on the From event tab, choose the startDate and endDate columns in the Start time and End time fields. Click Apply to save the configuration.
Then, on the From event tab, choose the startDate and endDate columns in the Start time and End time fields. Click Apply to save the configuration. |
Reducer We will use a couple of Reducer units to store all the events received during the query periods set, combine and format them and finally emit an only event with all the alerts triggered during those periods.  | Drag 2 Reducer units to the canvas and link them to the Devo Full Query units as follows:
Now follow the steps below to configure both units:
Click Apply to save the configuration.
Click Apply to save the configuration. |
Reducer We will use an additional Reducer to combine the information stored by the previously added Reducer units and send the final report with the alert info from both time periods. | Drag a Reducer unit to the canvas and link it to the previously added Reducers in the following order:
As said in the introduction of this article, remember that the link order matters. You must link the ports in the order described above. Then, open the configuration options of the unit by double-clicking it. Add a Name to the unit (in this example, we called it combineMessages). Leave the Language as default (Groovy) and enter ““ in the Init Value field. Set the Field Name as combinedMessage and choose String as Accumulator Type. Then, enter the following in the Expression field: Click Apply to save the configuration. |
Email Sink We will use this unit to send the reports generated to the required user emails. | Drag an Email Sink unit to the canvas and link the current port of the Reducer unit to the in port of this unit, as follows:
|
Once you're done, remember to save your Flow so you can start running it. To do it, click the Save button on the Flow toolbar.
Result
Once you have defined the whole Flow and saved it, click the Start button to activate it. If everything is correctly configured, the Flow will send an email to the given addresses with a report comparing the alert count over the last hour with the alert count over the same hour and day of the previous week.
Import this Flow
Download this Flow in JSON format and import it to your domain clicking the Import from JSON option in the File menu.
Remember to add the required target email addresses as explained above before running the Flow.
Â