Observability Alerting - Throttling/Acknowledge - Based

[erikg]

Hello,

I been creating some alerts using Inventory/Metrics to be able to alert like on CPU usage. I can't seem to find in the documentation how we can implement throttling in this alerts (in order to avoid spam).

Also for the type of throttling, it would really cool if there was a way to allow end users to acknowledge an alert to avoid getting repeats of the same alert.

Would like to hear your thoughts on this?
Thanks,
Erik

[stephenb (Stephen Brown)]

What Version??...

There is a choice In Action Frequency "Only On Status Change"

You will only get an Alert when the Alert Fires and one When the Alert Recovers.... no spamming...

[BenB196]

it would really cool if there was a way to allow end users to acknowledge an alert to avoid getting repeats of the same alert.

You can mute alerts after they fire, however, this is currently somewhat obscure in the current Kibana UI. You need to go to the Rules section in the Stack Management section, to mute individual alerts within the rule.

This appears to be getting improved with [RAM] Move common alerts table actions to triggersActionsUI by umbopepato · Pull Request #170651 · elastic/kibana · GitHub making the mute/unmute of an alert show up in the more upfront alerts table.