Skip to main content

​
Where Are Filter Conditions Used?

Filter conditions apply to the following scenarios:
ScenarioDescription
Escalation RulesA single channel can have multiple escalation rules, each with different filter conditions to set different assignees for different incidents
Silence RulesSet filter conditions to match specific incidents; matching incidents will be silenced
Inhibit RulesSet filter conditions to match newly triggered incidents and existing active incidents; when new incidents match, they are inhibited
Alert GroupingSet filter conditions to match specific alerts and configure new grouping dimensions for them
Routing RulesWhen using Integration Center alert integrations, set global routing rules to route different alerts to specific channels
Label EnhancementSet filter conditions to match specific alerts; matching alerts generate labels according to rules
Alert ProcessingSet filter conditions to match specific alerts; matching alerts are processed according to rules

​
How to Configure Filter Conditions?

​
Rule Design

Flashduty On-call abstracts the entire filter condition system, aiming for minimal configuration while meeting most scenario requirements. The overall judgment logic consists of multiple condition groups:
  • Conditions within a group: AND relationship—each condition must match for the group to match
  • Between groups: OR relationship—any group matching means overall match
Within each condition, there’s a field, operator (oper), and target values:
  • Match: Target can have multiple values; if any value satisfies the condition, that condition matches
  • Not Match: Target can have multiple values; if all values don’t satisfy the condition, that condition matches
Target values in conditions are all strings, supporting exact, regex, wildcard, IP range, and numeric comparison matching methods.
Filter Condition Example As shown above, we have two condition groups, each with two conditions, and conditions have multiple match values. The expression is: 
( severity == Critical|Warning && labels.check == Binlog Sync Delay )
or
( labels.check == /cpu/|/io/|/disk/ && labels.value == num:gt:90 )

​
Matching Methods

When a value string has / as prefix and suffix, the entire value is recognized as regex.Example:
  • labels.check: /outage/ — matches when check label contains “outage”
Flashduty uses RE2 regex specification platform-wide. Some Perl syntax may not match. You can use AI Chatbot to generate expressions and verify at RE2 Playground.

​
FAQ

Flashduty On-call receives large volumes of data. To ensure system stability, the system only searches the most recent 500 alert events from the past 24 hours for label deduplication. Therefore, extracted labels may change dynamically, or no labels may be extracted if there’s no new data in the past 24 hours.In this case, you can manually enter labels.
Flashduty uses RE2 regex specification platform-wide. Some Perl syntax may not match. You can use AI Chatbot to generate expressions and verify at RE2 Playground.