Alerting profile - filter by "contains" on Predefined

[yair_mashmor]

Hello,

Im trying to find a way to filter events in an Altering profile, so that predefined events of type "failure rate increase" will be negated, if they contains in the title a certain substring.

The point is to filter a bunch of services that always get altered on by dynatarce and are not merged into a "main" problem (another case about that with support).

So basically this, with a filter on the title:

But i have only seen that a filter on a title is possible for a "custom" alert.

Does anybody know how can this be achieved?

Thank you,

Yair

[ryan_ott · Accepted solution]

Hello,

AFAIK, you should be able to use the 'custom' event filter for this purpose - even though it is a predefined event type. You could negate if the title contains particular text, as well as if the description contains 'Failure rate increase', for example. Or, vice versa.

Hope this helps.

-Ryan

[yair_mashmor]

Thank you Ryan.

Ha, 

I tried just that, and it didnt work so i figured im doing something wrong. consulated support and they said its because i used a 'custom' type instead of predefined.

But i will give it another go and see i can tweak it to make it work.

Appreciate your replay.

Yair

[matthias_dillie]

HI

It would be very helpful to have additional filter possibilities in the alerting profiles beside the management zone. It should be possible to alert only for defined hosts or processes using names or tags. Or exclude hosts or processes.

Regards, Matthias

[kalle_lahtinen]

Hi Ryan,

I've also investigated this with support, and it indeed seems that those custom filters only apply to custom events - not predefined ones. So there is actually no way to easily filter out a specific entity from alerting. You basically have to tag everything you want to alert about (except that 1 thing), and then add that as a filter in the severity rule(s). So the available ruleset only allows inclusion, not exclusion 😞 How easy would it be to just quickly tag something as "do_not_alert" and then add to the severity rule that those tags should be excluded. But it's not possible unfortunately.

I think the documentation on this needs serious work:

https://www.dynatrace.com/support/help/how-to-use-dynatrace/problem-detection-and-analysis/notificat...

The examples for custom filters refer to predefined alerts like CPU saturation, which is super misleading.

Btw I tested this manually as follows:

1. Created http monitors Synthetic1 and Synthetic2

2. Created custom events Custom1 and Custom2

3. Created alerting profile which contains severity rules for availability and custom alerts

4. Added custom filters to exclude Synthetic2 and Custom2

5. Made it so that all 4 created a Problem at Dynatrace

-> When filtering with that test alerting profile, Synthetic2 remained visible but Custom2 was filtered out. So the custom filters did not affect the http monitor, because it was not of type "custom".

[wolfgang_beer · Accepted solution]

You are right, we were never able to text filter on the built-in event types because the text was added on top in the UI only.

BUT within the next 6 weeks we will add those texts as well for the built in event types for the purpose of sending those text to Grail as well as to our mobile app and in corse of this step we will also add the text filter in alerting profiles for the built in event types.

By the way we will also soon introduce event property filters in the alerting profiles, so that you can use any event property as a filter.

Best greetings,

Wolfgang

[kalle_lahtinen]

Thanks for the update Wolfgang, these enhancements sound really good! 👍

[ChadTurner]

@ryan_ott is exactly right! let us know if you need anything additional