How does watcher throttling work?

Elastic Stack Elasticsearch
1

Hi all,

We are trying to configure watchers with throttling period so that we do not receive duplicate notifications of same alerts. We were expecting throttling period to work in two ways-

  1. If watcher condition is true and it becomes false then the throttling period will get reset (even before throttle period expires)
  2. If watcher condition remains true then throttling should reset only after the defined period.

However, during our testing what we are seeing is that throttling waits for full throttle period before it triggers again. It does not depend on condition true/false change during throttle period.

Can you please confirm on the throttle behaviour and if it is only dependent on throttle period?

Thanks

2

@Abhimanyu_Garg

Throttling depends only on the time period you have specified in watcher.

If you configure watcher with throttling period of 30 mins, then all the further alerts for next 30 mins will be suppressed. It doesn't reset throttling period if the watcher condition becomes false.

Thanks

3

Thanks for confirming.

4

However, throttling feature should actually consider time as well as the condition.
If condition becomes true and false again, the throttling time should reset. That way we can configure different actions in same watcher.

5

@Abhimanyu_Garg Sure, throttling will help to reduce noise during an incident, and if you are trying to address a different challenge please raise a feature request in elastic github.

6

One more thing: While you are doing your testing, are you storing the watch again during that time? If so, the throttling is reset as well.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.