Unified Alert Grouping
Unified Alert Grouping combines Content-Based Alert Grouping and Intelligent Alert Grouping with a flexible time window for increased precision and correlation control. Unified Alert Grouping will group alerts when alert content matches and Intelligent Alert Grouping determines alerts are similar. Alerts will group only when both conditions are satisfied.
Availability
This feature is available with our PagerDuty AIOps add-on.
Required User Permissions
Users with the following roles can edit a service’s Alert Grouping settings:
- Account Owner
- Admin and Global Admin
- User
- Manager base role and Team roles
Enable Unified Alert Grouping
- Navigate to Services Service Directory and select the name of your desired service.
- Select the Settings tab and click New Grouping in the section Reduce Noise.
- Select Intelligent + Alert Content.
- Select whether you want alerts to be grouped if All or Any specified fields match.
- If All is selected, alerts will match when content is exactly the same.
- If Any is selected, alerts will match when at least of the fields is present.
- In the dropdown below Match alerts based on, select which alert field you'd like to match on before Intelligent Alert Grouping consider alerts' similarity.
- Optional: Click Add Field to add additional content-based matching criteria.
![Configure Unified Alert Grouping](https://files.readme.io/f5f4fa6-unified_alert_grouping.png)
Configure Unified Alert Grouping
- Select the desired grouping time window for alerts on the service. The Recommended time window indicated in the dropdown uses historical service data to calculate the average time between alerts.
- Click Save Settings.
Email Events
Please note that Content Based Alert Grouping does not support email integrations at this time.
Disable Unified Alert Grouping
To select a different grouping method, or to disable Alert Grouping all together, in the web app:
- Navigate to Services Service Directory and select the name of your desired service.
- Select the Settings tab and click Edit next to Reduce Noise.
- In the bottom-left, click Delete.
- In the confirmation modal, click Yes, turn off.
Unified Alert Grouping Behavior
Consider the following alerts:
Alert 1
Summary: “High CPU load on AWS EC2 instance” custom_details.source:”Datadog”
Alert 2
Summary: “High CPU load on AWS EC1 instance” custom_details.source:”Splunk”
Intelligent Alert Grouping by itself would likely detect these two as similar, and group them together. However, with the greater control that Unified Alert Grouping offers, you can specify to that alerts should only group if custom_detail.source
matches.
As another example, in the following configuration, Unified Alert Grouping specifies that the host
must match before Intelligent Alert Grouping considers alerts for grouping.
![Unified Alert Grouping: custom_details.host](https://files.readme.io/3fced92-custom_details_host.png)
Alerts must match on custom_details.host
The incident in the following screenshot shows that the host name matched, and that the summary fields were similar enough for Intelligent Alert Grouping to group them together.
![](https://files.readme.io/dd7fcc0-grouped_alerts.png)
Updated 3 months ago