Elastic Synthetics Alerts in the same workspace to different teams

Should the uptime rules respect the alerts enabled/disabled switch from the synthetics app, like the synthetics rules do? I've configured two rules per your instructions, but they're sending alerts for tests which I currently have set to not send alerts.

No, you should not expect these two features to interoperate. The Synthetics Alert will be improved in the future to scope in richer features and configurability, but for now that toggle only controls the Synthetics alert. The Uptime alerts are unaware of that feature. You should be able to disable any Uptime rules via the Observability Alerting page.

When I do a GET on the default synthetics rule, it shows that it executes every 1m and there don't seem to be any parameters set, so I'm using ANY MONITOR IS DOWN >= 1 times WITHIN last 10m , which seems to work well enough.

Yes this is the way that alert was designed to work. We will improve the alert in a future release but for now this feature operates within those limitations. I'm glad you're able to configure the Uptime alert to achieve your goal!

  • I observe that I can GET the synthetics rule to view it through the API. Can I also create one through the API, even if I can't create/modify it through the UI?

At the moment, the Synthetics alert operates as a singleton across the whole deployment. It's not possible to create a second or n alerts in a supported manner at this time. As I mentioned above, we plan to make this significantly more powerful in a future release.

I can't find a field in synthetics-* which shows whether alerts are enabled or disabled for the test. Is there a metadata field that I can pull from in a custom ingest pipeline? Or do you have a suggested solution, other than setting a tag on the alerts that should be ignored?

If you're making Uptime alerts with custom parameters to check given monitors (i.e. if you have specific tags for certain monitors and want to alert on them separately), you can manage those rules from the Observability Alerts page, as shown in this screenshot below. I hope that answers your question, if not please let me know.

1 Like