Application Real-Time Monitoring Service:Event processing flow

Create an event processing flow

1. Log on to the ARMS console.

2. In the left-side navigation pane, choose Alert Management > Event Processing Flows.

3. On the Event Processing Flows page, click Create Processing Flow in the upper-right corner.

4. On the Create Processing Flow page, enter a name for the processing flow in the Basic Information section.

5. In the Flow Action Settings section, configure the event processing flow.

   1. Drag actions from the Available Actions section to the Event Processing Flows section.

   2. In the rightmost section, configure the execution conditions for each action in the event processing flow.

      Note

      After you configure an action, you can test alert fields in the Test Data section to verify the action's configuration.

      Action	Description	Example
      Trigger Condition	Only events that meet the trigger condition will initiate the current event processing flow.	Scenario An integration named Container CPU Utilization Alert triggers the current event processing flow. Configuration Set the condition to _aliyun_arms_integration_name equals Container CPU Utilization Alert.
      Filter Events	Events that meet the filter conditions skip the current event processing flow and proceed to the next one. Unfiltered events continue to the next action in the current flow. Note If your alert rule has not yet generated an event, you can configure only the preset ARMS fields _aliyun_arms_integration_id and _aliyun_arms_integration_name. If you need to use other event fields such as severity or alertname, you can use one of the following methods: Manually enter the field name. Add an alert rule and trigger an alert event. Once the event is generated, you can select its fields. Execution Result Execution Result Execution Result Execution Result Execution Result	Scenario Alert events with a P4 level do not trigger the current event processing flow. Configuration Set the condition to severity equals P4.
      Identify Event Type	Based on the values of selected event fields, an algorithm identifies the event class and event type. This information supports event and alert queries and statistical analysis. The following event classes are supported: Network Storage Compute OS Application Database Change The following event types are supported: Availability Latency Capacity Error Unknown	Scenario Identify the event class and event type based on the values of the alertname and message fields. Configuration Set Fields for Type Identification to alertname and message. Execution Result The system writes the identification results to the class and type labels. For example, after an event with an alertname of tcp package error percentage is processed, the class in the extended fields is set to network, and the type is set to error.
      Set Event Level	Assigns a specific event level to events processed by the current flow.	Scenario Set the event level of network-related alert events for core services to P1. Configuration Set the Trigger Condition action to class equals network. Set the Set Event Level action to P1. Execution Result The test result shows that after processing, the severity field is set to critical, which indicates that the rule was applied successfully.
      Set Business Tag	Adds a business tag (label) to events processed by the current flow. This tag supports event and alert queries and statistics. Field: Use the value of an event field as the value of the label field. Value: Set a fixed value for the label field.	Scenario Use the alert level as an alert label to enable statistical analysis of events by level. Configuration Set the business tag to Field: severity. Execution Result A label field will be added to alert events, and the value of the label field is the value of the severity field.
      Delete Field	Deletes specified fields from an event.	Scenario An alert event contains both location and region fields. The location field already includes region information, so delete the region field. Configuration Set the field to be deleted to region.
      Extract Content	Extracts content from an event field by using a regular expression and populates new fields with the extracted data.	Scenario Alert field: "location":"cn-hangzhou-hz4" Extract the region and data center information from the location field and populate the region and datacenter fields. Configuration Field to Extract From: location Extraction Regex: ([a-zA-z]+-[a-zA-z]+)-(.*) Fields to Populate: region, datacenter The extracted result for the region field is cn-hangzhou, and the result for the datacenter field is hz4.
      Match and Update	If a specified event field contains certain content, the system populates a target field with a configured value.	Scenario Alert field: "message":"ping to i-bp1e42d0ydxf7pstuepz > 100ms" If the message field contains ping, this indicates a network event, and the event is marked as a network type. Configuration Field to Match: message Update Condition: If contains ping, output network. Note The value to match can be a literal string or a regular expression. Field to Populate: class After testing the match and update action, if an event's message field contains ping, the system populates the class field with network.
      Enrich Field	Enriches event data by calling an API or querying a local Excel data source, and then populates a target field with the result. Note The data source feature is currently in canary release. To use this feature, contact ARMS technical support on DingTalk (ID: d9j_rg9e4062f).	Scenario Use the IP field in an alert event to query an uploaded Excel data source to retrieve the corresponding host name and populate the event's hostname field. Configuration Data Source: Get Host Data Source-excel Match and Update Mode: ip (matches the column name in the Excel file) equals ip (matches the column value in the Excel file) Field to Populate: $.hostName (column name from the Excel query result) populates hostname
      Replace Content	Finds and replaces content in a specified field using a literal string or a regular expression.	Scenario Replace the string d.b. in an alert event with the string database. Configuration Field to Replace In: message Find: d\.b\. Note You can use a literal string or a regular expression. Replace With: database Click Test. Before processing, the value of the message field is d.b. call timeout. After processing, the value changes to database call timeout, which indicates that the replacement rule is effective.
      Split Content	Splits a field's value by a delimiter and uses the results to populate multiple target fields.	Scenario Alert field: "message":"myhostid_myuserid_myruleid" Split the value of the message field, and populate the new hostid, userid, and ruleid fields with the resulting parts respectively. Configuration Field to Split: message Delimiter: _ Fields to Populate with Split Results: hostId, userId, ruleId Note The target fields are populated in sequential order.
      Populate from Template	Enter template content (for example: The event source of type ${class} is ${source}). The variable names are the field names from the event integration, and the content is populated into the target field after the template is rendered.	Scenario Alert fields: "source":"server", "class":"network" Set the message field to Event of type ${class} is from source ${source}, referencing the values of the class and source fields. Configuration Template: Event of type ${class} is from source ${source} Field to Populate: message The message field is rendered as Event of type network is from source server, with template variables replaced by their corresponding field values.
      Discard	Discards events processed by the current flow. This action must be the final node in an event processing flow and requires no configuration.	None

6. In the Test Data section, enter test fields and values on the left, or click Select From Events to test an existing alert event. Then, click Test.

7. After you complete the configuration, click Save.

   After the event processing flow is created, the system filters events from integrated alert sources based on the flow sequence. You can view the filtered events on the alert event history page. For more information, see View alert event history.

Manage event processing flows

After creating event processing flows, you can manage them on the Event Processing Flows page:

• To change a flow's order, click Up or Down in the Actions column.

• To enable or disable a flow, click Enable or Stop in the Actions column.

• To update a flow, click Edit in the Actions column.

• To delete a flow, click Delete in the Actions column and then click Confirm.

View processed alert events

In the left-side navigation pane, choose Alert Management > Alert Event History.

The Alert Event History page shows all alert events. Click an event name to view its details. For more information, see View alert event history.