Inverse Wildcard Filtering in Alarm Templates

42 views
1
0 Comments

Is there a way to do any sort of inverse filtering using wildcards in an Alarm Template? I have a working template but it's applying thresholds to backup feeds that don't have those settings active because they're backups. I tried doing a simple reverse wildcard (like -*BACKUP*) but that only managed to break that Alarm Parameter completely.

Miguel Barquet [SLC] [DevOps Enabler] Answered question 1 day ago

1 Answer

2
1.81K 1 Comment

The solution is to use exclusion by unchecking monitoring in the alarm template as follows:

  1. Duplicate the table parameter in your alarm template
  2. In the filter field of the first entry, specify what to exclude (e.g., *NATS*)
  3. Uncheck the monitoring box for this filtered entry
  4. Leave the row with the filter * (catch-all) at the bottom with monitoring enabled
  5. Ensure the exclusion rule is positioned above the catch-all filter (*)

Example for excluding NATS:

  • Row 1: Filter = *NATS*, Monitoring = unchecked
  • Row 2: Filter = *, Monitoring = checked

This works because rules are evaluated top-to-bottom, and the first matching rule applies.

The result:

Matt Murphy Posted new comment 1 day ago
Matt Murphy commented

Thank you for this, and for clarifying the logic on how the filters worked. I tested this out and it worked perfectly to keep the thresholds from applying to the backup sources.