JSON Format for Alerts
Alerts may be published to an HTTP server or Syslog server using JSON format.
The JSON may be customized via the System Parameters page.
An example of the JSON format:
{
"uuid": "4f83f62a-af7a-47f2-962b-5ff28b91a069",
"environment": "prod",
"name": "Devices CPU Metric",
"type": "Flatline",
"description": "An alert of Devices CPU Metric has been generated for Device idg_10_6_0_a",
"timeIntervalStart": 1728397125025,
"timeIntervalEnd": 1728397425025,
"creationTime": 1728397441899,
"value": "10.0",
"threshold": 2.0,
"subject": {
"Device": "idg_10_6_0_a"
},
"subjectTerms": "Device=idg_10_6_0_a",
"subjectKey": "idg_10_6_0_a",
"investigateUrl": "http://dpod-server/op/#deviceResources:-productView:idg-deviceNameOp:eq-deviceName:idg_u10_u6_u0_ua-timeRangeType:custom-timeRangeStart:1728397125025-timeRangeEnd:1728397425025"
}
Field Name | Description |
|---|---|
uuid | A random UUID, unique for each alert |
environment | The DPOD environment name (usually "dev", "prod", etc.) |
name | The name of the alert as defined in DPOD in the list of alerts or the name of the internal alert. |
type | The type of alert (Flatline, Frequency, InetrnalAlert...) |
description | A human-readable description of the generated alert with the subject details |
timeIntervalStart | The start time in milliseconds from epoch of the query period (e.g.: 5 minutes ago if the alert runs every 5 minutes). |
timeIntervalEnd | The end time in milliseconds from epoch of the query period. |
creationTime | The time in milliseconds from epoch when the alert was generated. |
value | The results of the query of the alert that triggered the alert. For example the CPU utilization in percentage. |
threshold | The threshold that was set to determine if the value should generate an alert or not. |
subject | An element that contains all of the fields that identify the subject/component of the alert. For example it can include the device name, the domain name and the service name (if the alert is at service level). |
subjectTerms | A string that identifies the subject/component of the alert and contains all the subject terms with their field names ("field=value"). |
subjectKey | A string that identifies the subject/component of the alert and contains all the subject values only (e.g.: the device name). |
investigateUrl | A URL that can be used to investigate the alert in DPOD. It should display the raw data that triggered the alert. |