Kibana Alerts - Action on Recovered contains no context.group

[JMisset88 (Jasper)]

Hi,

We recently upgraded from Elastic 7.10.0 to 7.12.0. Mainly because I saw the new Alerting/Action functionality to only send an Alert on a Status Change (instead of on an interval). This is a very nice feature, however, I've noticed that the Recovered Alert does not contain the context.group information.

So whenever I get a slack Alert that tells me about the specific grouping variables (in our case, kubernetes.cluster.name, pod name, container name) I can see this information when the state changes to Alert, but not when the state changes to OK..

I have configured the following Slack Actions within the same Alert;

Run when: Alert
Message: A container will not start up. Cluster, Namespace, Pod, Container, Status:
{{context.group}}

Run when: Recovered
Message: A container Recovered. Cluster, Namespace, Pod, Container, Status:
{{context.group}}

This results in the following Slack messages:

A container will not start up. Cluster, Namespace, Pod, Container, Status:
testcluster, testnamespace, testservice-855bcd9849-rlvmt, testservice, CrashLoopBackOff

A container Recovered. Cluster, Namespace, Pod, Container, Status:

Am I doing something wrong? Is there another way to include the same information in the Recovered Alert?

Thanks in advance!

Jasper

[stephenb (Stephen Brown)]

Hi @JMisset88 Welcome to the community!

No its not you. At this time that data is not available.

You can use the to help with the alignment / correlation at this time.

"alertId" : "{{alertId}}",
"alertInstanceId" : "{{alertInstanceId}}",

I will open an issue, when I do I will notify you perhaps you can add your use case ++ to it.

[stephenb (Stephen Brown)]

Update there is an Issue Here . It is a bit low level but I I will add this / you discuss context / use case in there for reference.

[JMisset88 (Jasper)]

Hi Stephen,

Thanks for your reply. I will check out the alertId's for correlation and keep an eye on the issue.