Data structure of alert resource data - Simple Log Service

Each alert resource type, such as users, policies, and templates, has a defined data structure consisting of resources and records.

Introduction

Alert resource data includes users, user groups, on-call groups, webhook integrations, alert policies such as route consolidation, inhibition, and silence policies, action policies, content templates, and other custom resource data.

Note

Inhibition policies are not recommended.

Alert resource data is classified into two categories: resources and records. For example, a user is a resource, and the information about that user is a record.

Category	Property	Description
Resource	resource_name	The name that identifies the resource. For example, the resource name of a user is sls.common.user.
Record	id	The unique ID of the record. Data type: string.
	tag	The tag of the record. Data type: string.
	value	The complete value of the record. Data type: JSON string.

Structure of alert resource data

Resource type	resource_name field	record_id field	record_tag field	Example	Remarks
User	sls.common.user	user_id	user_name	`{ "user_id": "alex", "user_name": "Alex", "email": [ "*@example.com" ], "country_code": "86", "phone": "133**3333", "enabled": true, "sms_enabled": true, "voice_enabled": true }`	None
User group	sls.common.user_group	user_group_id	user_group_name	`{ "user_group_id": "devops", "user_group_name": "DevOps Team", "enabled": true, "members": [ "alex" ] }`	None
On-call group	sls.alert.oncall_group	oncall_id	oncall_name	{ "oncall_id": "default_oncall", "oncall_name": "Default Oncall", "enabled": true, "overrides": [], "rotations": [ { "targets": [ { "type": "user", "target_id": "alex" }, { "type": "user_group", "target_id": "devops" } ], "end_time": 0, "shift_day": "", "shift_time": "12:00", "shift_type": "day", "start_time": 1633017600, "shift_minute": 0, "end_time_type": "none", "shift_interval": 1, "shift_week_custom": null, "restriction_date_type": "workday", "restriction_time_type": "allday", "restriction_week_range": null, "restriction_time_custom_range": null } ], "calendar_id": "default_calendar" }	This configuration is complex. We recommend that you use the console instead.
Webhook integration	sls.alert.action_webhook	id	name	`{ "id": "custom-webhook", "name": "Custom Webhook", "type": "custom", "url": "http://localhost:9099/data/webhook", "method": "POST", "headers": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Foo", "value": "bar" } ] } { "id": "dingtalk", "name": "Dingtalk Webhook", "type": "dingtalk", "url": "https://oapi.dingtalk.com/robot/send?access_token=********", "method": "POST", "secret": "SEC********", "headers": [] }`	Set type to the webhook type. Valid values: dingtalk: DingTalk. wechat: WeCom. lark: Lark. slack: Slack. custom: custom webhook. For all types except custom, set method to POST and headers to an empty array. If you set type to dingtalk or lark, and set the security check method to signature verification in DingTalk or Lark, you must add the secret field. You can obtain the signature key from the bot management interface in DingTalk or Lark.
Alert policy	sls.alert.alert_policy	policy_id	policy_name	{ "policy_id": "sls.builtin", "policy_name": "SLS Builtin Alert Policy", "parent_id": "sls.root", "is_default": false, "group_script": "fire(action_policy=\"sls.builtin\", group={\"project\": \"__a__\", \"uid\": alert.aliuid}, group_wait=\"5s\", group_interval=\"2m\", repeat_interval=\"2m\")\nstop()\nfire(action_policy=\"sls.builtin\", group={\"alert_id\": alert.alert_id}, group_wait=\"5s\", group_interval=\"10s\", repeat_interval=\"2m\")\nif alert.labels.name ~= \"^\\\\w+s$\":\n\tfire(action_policy=\"sls.builtin\", group={\"product\": \"xxs\"}, group_wait=\"5s\", group_interval=\"10s\", repeat_interval=\"2m\")\n\tstop()\nstop()\nfire(action_policy=\"sls.builtin\", group={\"label_name\": alert.labels.name}, group_wait=\"10s\", group_interval=\"10s\", repeat_interval=\"2m\")", "inhibit_script": "if alert.severity >= 8:\n silence alert.severity < 6", "silence_script": "" }	Set is_default to false. group_script is the route consolidation policy. inhibit_script is the inhibition policy. silence_script is the silence policy. If you configure these fields by using an SDK, group_script, inhibit_script, and silence_script contain only DSL script information without UI metadata. The console cannot render the corresponding graphical structure.
Action policy	sls.alert.action_policy	action_policy_id	action_policy_name	{ "action_policy_id": "sls.builtin", "action_policy_name": "SLS Builtin Action Policy", "labels": {}, "is_default": false, "primary_policy_script": "fire(type=\"webhook_integration\", integration_type=\"dingtalk\", webhook_id=\"dingtalk-test\", template_id=\"default-template\", period=\"any\")", "secondary_policy_script": "fire(type=\"voice\", users=[\"jizhi\"], groups=[\"group-jizhi\"], template_id=\"default-template\")", "escalation_start_enabled": false, "escalation_start_timeout": "10s", "escalation_inprogress_enabled": false, "escalation_inprogress_timeout": "10s", "escalation_enabled": false, "escalation_timeout": "4h0m0s" }	Set is_default to false. labels is a reserved parameter. Set it to a null object. primary_policy_script is the primary action policy. secondary_policy_script is the secondary action policy. escalation_* fields control whether to enable the secondary action policy. For details, see the configuration items in the console. If you configure these fields by using an SDK, primary_policy_script and secondary_policy_script contain only DSL script information without UI metadata. The console cannot render the corresponding graphical structure.
Content template	sls.alert.content_template	template_id	template_name	{ "template_id": "default-template", "template_name": "Default Template", "is_default": false, "templates": { "fc": { "limit": 0, "locale": "zh-CN", "content": "", "send_type": "merged" }, "sms": { "locale": "zh-CN", "content": "" }, "lark": { "title": "Alerthub alert test ${alert_name}", "locale": "zh-CN", "content": "" }, "email": { "locale": "zh-CN", "content": "", "subject": "SLS alert test-jizhi-test" }, "slack": { "title": "Alerthub alert test ${alert_name}", "locale": "zh-CN", "content": "" }, "voice": { "locale": "zh-CN", "content": "" }, "wechat": { "title": "Alerthub alert test ${alert_name}", "locale": "zh-CN", "content": "" }, "webhook": { "limit": 0, "locale": "zh-CN", "content": "", "send_type": "batch" }, "dingtalk": { "title": "Alerthub alert test ${alert_name}", "locale": "zh-CN", "content": "" }, "event_bridge": { "locale": "zh-CN", "content": "", "subject": "wkb-test" }, "message_center": { "locale": "zh-CN", "content": "" } } }	Set is_default to false. templates contains the template configurations for each notification channel. If the content value for a channel is empty, the system's default template is used. For more information, see Default content templates. The value of locale can be zh-CN or en-US. For the webhook and fc channels, the value of send_type can be single or batch. single indicates that notifications are sent for each alert. batch indicates that alerts are merged and sent as a single notification.
Default calendar	sls.common.calendar	calendar_id	calendar_name	`{ "calendar_id": "default_calendar", "calendar_name": "Default Calendar", "timezone": "Asia/Shanghai", "workdays": [ 1, 2, 3, 4, 5 ], "worktime": [ { "end_time": "21:00", "start_time": "09:00" } ], "reset_days": [], "holiday_sync": "china" }`	The ID of the default calendar is fixed as default_calendar. This configuration is complex. We recommend that you use the console instead.

DSL syntax description

The following sections show example DSL configurations for each policy type.

Important

DSL configuration is complex. We recommend that you configure policies in the console first, then inspect the network request payload.

Set a route consolidation policy

Console configuration
DSL configuration
```
if alert.severity >= 8:
    fire(action_policy="sls.builtin", group={"alert.project": alert.project, "alert.alert_id": alert.alert_id}, group_by_all_labels=true, group_wait="15s", group_interval="5m", repeat_interval="1h")
    stop()
fire(action_policy="sls.builtin", group={"alert.project": alert.project}, group_by_all_labels=false, group_wait="15s", group_interval="5m", repeat_interval="1h")
```
The basic syntax is described as follows:
- if alert.severity >= 8 is a condition node.
- fire() is a route consolidation node.
  - action_policy is the action policy ID.
  - group is the consolidation baseline. The data type is dict.
  - group_by_all_labels specifies whether to consolidate alerts based on all labels. Valid values: true and false.
  - group_wait is the initial wait time.
  - group_interval is the wait time for changes.
  - repeat_interval is the repeat wait time.
- stop() is the end node.

Set an inhibition policy

Console configuration
DSL configuration
```
if alert.severity >= 8:
    silence alert.severity < 8
    stop()
```
The basic syntax is described as follows:
- if alert.severity >= 8 is a condition node.
- silence alert.severity < 8 is an inhibition node.
- stop() is the end node.

Set a silence policy

Console configuration
DSL configuration
```
drop(end=1638189177) alert.alert_name == "test-alert"
accept alert.labels.env == "prod"
```
The basic syntax is described as follows:
- drop indicates silence.
- accept indicates that the alert is not silenced.
- start and end specify a time range as a UNIX timestamp in seconds.
  - Specific time range: Set start and end.
  - Until a specific time: Set only end.
  - For a period of time: Set only end.
  - Indefinitely: Do not set start or end.

Set an action policy

Console configuration

DSL configuration

if alert.severity >= 8:
    fire(type="sms", users=[], groups=[], oncall_groups=["alert-test-oncall"], template_id="sls.builtin.cn", check_quota="true", period="any")
    stop()
if alerts.severity < 8:
    fire(type="webhook_integration", integration_type="dingtalk", webhook_id="jizhi-test", template_id="sls.builtin.cn", period="any")
    stop()

Important

if alert.xxx indicates that the condition is met if any alert matches.
if alerts.xxx indicates that the condition is met if all alerts match.

The following section provides configuration examples for each channel:

Console configuration

DSL configuration

fire(type="sms", users=["jizhi"], groups=[], oncall_groups=[], template_id="sls.builtin.cn", check_quota="true", period="workday")
fire(type="voice", users=[], groups=[], oncall_groups=["alert-test-oncall"], template_id="sls.builtin.cn", check_quota="true", period="worktime")
fire(type="email", users=[], groups=["alert-test"], oncall_groups=[], template_id="sls.builtin.cn", check_quota="true", period="any")
fire(type="webhook_integration", integration_type="dingtalk", webhook_id="jizhi-test", template_id="sls.builtin.cn", period="any")
fire(type="webhook_integration", integration_type="wechat", webhook_id="wechat-test", template_id="sls.builtin.cn", period="any")
fire(type="message_center", template_id="sls.builtin.cn", check_quota="true", period="any")
fire(type="event_bridge", region="cn-hangzhou", bus_name="bus-demo", template_id="sls.builtin.cn", period="any")
fire(type="fc", region="cn-shanghai", service="jizhi-test", qualifier="LATEST", function="sls-ops-1", template_id="sls.builtin.cn", period="any")
fire(type="set_ticket_owner", choice="random", users=[], groups=[], oncall_groups=["alert-test-oncall"])

The basic syntax is described as follows:

Use fire() to set the notification channel. For more information, see Notification channels.