Rulesets FAQ
End-of-LifeRulesets and Event Rules webpages reached end-of-life on January 31, 2025 and are no longer visible in the PagerDuty web app. We highly recommend that you migrate to Event Orchestration as soon as possible so you can take advantage of the new functionality, such as improved UI, rule creation, APIs and Terraform support, advanced conditions, and rule nesting.
Access and modifications to event rules are still possible via the API.
FAQ
Are email integration filters and rules, or custom event transformers supported?
This depends on where you create event rules:
- Global rulesets: Email filters and rules are supported. Custom event transformers are not supported; however, global event rules autodetect and transform events sent to a global endpoint.
- Service event rules: Only basic email filters are supported, while email rules are not supported. Custom event transformers are supported.
Are events transformed into our Common Event Format (CEF)?
- Events that are routed transform into CEF.
- Global rulesets: Custom event transforms (CETs) are not supported.
- Service event rules: Custom event transforms (CETs) are supported.
What happens to events that do not match any rules?
- Global rulesets: Any events sent through event rules that do not match any rules are suppressed, and you can find them in the alerts table. You can change this default behavior by editing the catch-all rule at the bottom of your rules list.
- Service event rules: Any events sent through service event rules that do not match any rules turn into incidents and are not suppressed.
Is there a way to bulk add, delete, or edit global event rules?
Yes. You can leverage the Rulesets API to allow this functionality.
Once an event routes to a service from global event rules, are the event rules set up on the service respected?
Yes. Service event rules work in conjunction with your global event rules this way.
Can I send a second event with the same `dedup_key` and have it follow different actions?
If a second event with the same incident key passes and deduplicates into the open incident via global, team, or service event rules, the system does not follow the actions (such as raising priority or adding a note) except when severity is raised.
What happens if I do not create a deduplication key for an email sent to a ruleset?
As emails process, the email subject serves as a default deduplication key. In other words, emails with the same subject line automatically deduplicate. To change this behavior, add a custom deduplication key with an event rule action.
Is there a difference between the types of events processed by global event rules vs. service event rules?
Yes, global event rules are written against raw and untransformed events, whereas service event rules are written against transformed/PD-CEF events.
Why was my event not suppressed by a rule?
If there is an existing unresolved alert with the same dedup key as the incoming event, this event deduplicates into that alert and the "suppress" action in the event rules is ignored.
Updated 5 days ago