Create a Single Rule with Multiple Thresholds with Different Actions per Threshold?

[BenB196]

Hi All,

I was wondering if anyone know if the following is possible Rules and Connectors, as I wasn't able to figure out how to do it in the GUI.

Have a single rule, let's call it Disk Usage.

• The goal of this rule is to monitor disk usage for some hosts.

Have a threshold set to 90% usage, have an action that creates a ticket in a ticketing system.

Have a second threshold set to 95% usage, have an action that sends an email.

Have a third threshold set to 98% usage, have an action that sends a text message (SMS).

Right now from what I can tell, the only way to achieve this is to have 3 separate rules. I would like to avoid this, as this can quickly grow out of control. Is this currently possible?

[stephenb (Stephen Brown)]

So We Have Metric Threshold Rule here

With Alert and Warning and Recovered Actions

So we have 2 Levels today not 3 ... perhaps this would be a good start.

And file feature request (I kinda like the 3 Levels as well)

[BenB196]

Thanks @stephenb for the information.

A follow up question, it appears that these warning/alert is only available on the Metrics threshold rule type (at least in 7.14.x). While the example I provided was a metrics based one, I also have use cases that fall under other rule type: Index threshold, Elasticsearch query, and Uptime monitor status.

Are there plans to expand this functionality to all rule types?

Also, with regard to the number of levels feature request, do you think it would be better to ask for 3 level (i.e: Warning, High, Critical) or would it be better to ask for the ability to define an ( potentially unlimited) number of thresholds each with their own custom values (i.e: Info, Custom_Threshold_1, Panic Things are broken, etc...)

[stephenb (Stephen Brown)]

Hi @BenB196

@BenB196

Are there plans to expand this functionality to all rule types?

Yes I believe so but I do not have an ETA.
I think Observability Alerting will be a big focus in the coming releases.

@BenB196

Also, with regard to the number of levels feature request, do you think it would be better to ask for 3 level (i.e: Warning , High , Critical ) or would it be better to ask for the ability to define an ( potentially unlimited) number of thresholds each with their own custom values (i.e: Info , Custom_Threshold_1 , Panic Things are broken , etc...)

I have expressed the same "Wondering" ... I think we will go towards and established set first but I kinda like Custom Labels.

Definitely put in a feature request or Thumbs up if you find 1 already.

[BenB196]

Will do, thanks @stephenb!