Elastic Synthetics Alerts in the same workspace to different teams

I'm using Elastic Synthetics with Elastic Cloud v8.13.4. I am in the process of setting up in tests for some applications where alerts for tests which need to be in the same workspace need to be routed to different teams. E.g., the components are part of an overall application, but certain tests indicate issues with (for example) an API or Middleware component and need to be routed to a specific list.

I don't see an option to set up multiple Synthetics rules, so how can I do this?

I have the tests tagged by specific type, and ideally I'd like to be able to execute a rule that only watches tests with a specific tag.

Thx.

Hi @DougR, thanks for using Synthetics!

Today, the default alert provided by Synthetics is not configurable. This is a limitation of Synthetics that we are hoping to improve in an upcoming release. Our main recommended workaround for users who need more flexibility is to use the Uptime rules. Synthetics is a superset of Uptime data, so the older rules will work on it as well. There are a few steps to get this working, as Uptime is disabled by default in 8.13.

  1. Go to Kibana Advanced Settings and enable Uptime. Save settings.
  2. Navigate to the Uptime app and go to its settings view, and change the "Heartbeat indices" field value to synthetics*
  3. Go to the Observability Alerts view and manage alerts, you will see the Uptime rules are now available.

These older Uptime rules are more configurable and can be used in conjunction with alert actions like any other rule can.

Thank you. Two additional questions:

  • Should the uptime rules respect the alerts enabled/disabled switch from the synthetics app, like the synthetics rules do? I've configured two rules per your instructions, but they're sending alerts for tests which I currently have set to not send alerts.
  • How frequently do the default Synthetics rules run, and what are the parameters they're using (e.g., ANY MONITOR IS DOWN >= X times WITHIN last Y minutes)? When I do a GET on the default synthetics rule, it shows that it executes every 1m and there don't seem to be any parameters set, so I'm using ANY MONITOR IS DOWN >= 1 times WITHIN last 10m, which seems to work well enough.
  • I observe that I can GET the synthetics rule to view it through the API. Can I also create one through the API, even if I can't create/modify it through the UI?

Thx.

Update

When I check the individual tests in the uptime app, alerting shows as DISABLED for all tests, but all tests are actually sending alerts, even if DISABLED in Synthetics. I can't find a field in synthetics-* which shows whether alerts are enabled or disabled for the test. Is there a metadata field that I can pull from in a custom ingest pipeline? Or do you have a suggested solution, other than setting a tag on the alerts that should be ignored?

Thx.

1 Like