Label Enhancement

Documentation Index

Fetch the complete documentation index at: https://docs.flashcat.cloud/llms.txt

Use this file to discover all available pages before exploring further.

​

Core Uses

​

Configure Label Enhancement

​

Enhancement Types

​

Configuration Options

​

Configuration Examples

• Label Extraction
• Label Combination
• Label Mapping

Scenario: Alert events come from email integration; need to extract key information from description as labels for other scenarios, like extracting IP and trigger value from description as independent labels.

1

View Original Alert

2

Configure Extraction Rule

3

Verify Extraction Result

Scenario: Company’s log platform can access log details directly via domain + event ID + timestamp, but alert info only has event ID and timestamp labels, so need to combine these into an access URL.

1

View Original Alert

2

Configure Combination Rule

3

Verify Combination Result

Scenario: When source alert label values are variable and not intuitively meaningful, use mapping to map source labels to newly defined labels and values.Label mapping supports two mapping methods, selected via an inline radio toggle when adding a mapping rule — choose Schema or API:

Mapping Type	Description	Use Case
Schema (Mapping Table)	Static mapping via predefined CSV mapping table	Mapping relationships are relatively fixed with limited data
API (API Mapping)	Dynamic mapping by calling external API service	Need to query external systems (e.g., mapping api) for real-time data

• Schema Mapping
• API Mapping

Example: Source alerts only have resource type IDs, want to show corresponding resource type names.

1

Prepare Mapping Table File

Prepare a CSV format mapping table file to map resource type IDs in alerts to actual resource type names.

ID	Type
A	server
B	router
C	gateway
D	database
E	MQ

2

Create Mapping Table

1. Go to Configuration → Mappings → Schema → Create mapping schema
2. Fill in basic info like name, description, management team, etc.
3. In Mapping Table Data, upload the prepared CSV file (if quantity is small, you can edit and add in mapping details page after creation)
4. Select Source Label (e.g., ID), select Target Label (e.g., Type)
5. Click Create to complete mapping table creation

3

Configure Mapping Relationship

4

Verify Mapping Result

Original Alert: Reported alert info only has resource ID, no resource type name.

Mapping Result: Through configured mapping relationship, map resource ID to new resource type name label.

Example: Need to query responsible team, service tier, and other dynamic data from mapping api system based on host information in alerts.

1

Create Mapping Service

1. Go to Configuration → Mappings → API → Create API
2. Fill in service configuration:

Configuration	Description	Example
Service Name	Readable name for the service	Mapping api Asset Query Service
Description	Service purpose description	Query asset info by host IP
Request URL	API request address	https://mapping-api.example.com/v1/enrich-event
Headers	HTTP request header configuration	X-Auth-Token: your-token
Timeout	Request timeout, 1-3 seconds, default 2 seconds	1
Retry Count	Retry count on failure, 0-1 times, default 0 times	1

If the API uses HTTPS with an untrusted certificate, you can enable the Skip Certificate Verification option.

2

Configure Mapping Rule

Add a mapping rule in label enhancement, use the radio toggle to select mapping type as API:

1. Select the created mapping service
2. Configure Result Label List: specify label names expected from API response, e.g., owner_team, service_tier, host_ip
3. Enable Override option as needed

3

Verify Mapping Result

When an alert is triggered, Flashduty automatically calls the configured API service, sends alert event data to the external system, and adds the returned labels to the alert.

​

Mapping Data Management

​

Mapping Table Data Management

​

Mapping Service API Specification

​

Request Specification

{
  "result_label_keys": ["owner_team", "service_tier", "host_ip"],
  "event": {
    "account_id": 1,
    "channel_id": 20,
    "data_source_id": 15,
    "data_source_type": "prometheus",
    "description": "CPU usage for instance '10.0.1.1:9100' is over 95%",
    "title": "High CPU Usage on instance 10.0.1.1:9100",
    "alert_key": "d41d8cd98f00b204e9800998ecf8427e",
    "event_severity": "Critical",
    "event_status": "Critical",
    "event_time": 1678886400,
    "labels": {
      "region": "us-east-1",
      "service": "service-A",
      "env": "production",
      "instance": "10.0.1.1:9100"
    }
  }
}

​

Response Specification

{
  "result_labels": {
    "owner_team": "team-database",
    "service_tier": "tier-1",
    "host_ip": "10.0.1.1"
  }
}

​

Security Constraints

​

Best Practices

1. Performance First: The API is on the critical path of alert processing, must ensure low latency (recommended < 500ms)
2. Implement Caching: For identical query conditions, implement caching to improve performance
3. Idempotent Design: Multiple calls for the same event should return identical results
4. Secure Authentication: API must be protected by authentication mechanisms to prevent unauthorized access

​

Further Reading