This article applies to:
• Alerting
• Product edition: All
• Feature Category: Alerts
Overview
When creating an alert using Aria Apps API POST /api/v2/alert, error "The query in severity warn does not match the one in alertSources.query" ERROR could be received some scenarios/symptoms could be:
- Creating alert via Terraform
- Creating alert based on
GET /api/v2/alert/{alert_id}output
Cause
This happens because the displayExpression is different than the severe/warn conditions in the alert payload. They both need to match and hence this error returned, example:
- Incorrect
Resolution
A correct alert payload should look like:
- This happens often if the user uses GET alert API output to create an alert based on the output.
If Alert conditions severe/warn/info/smoke expressions are different the same error is received, for example:
- This payload will output error.
Terraform example:
### Terraform resource :
resource "wavefront_alert" "Temporal-frontend-service-availability-lv7" {
name = "Temporal-frontend-service-availability-lv7"
alert_type = "THRESHOLD"
additional_information = "Temporal-frontend-service-availability-lv7"
display_expression = "sum(rate(ts(\"temporal-prod-lv7-frontend.service_errors*\")))/sum(rate(ts(\"temporal-prod-lv7-frontend.service_requests*\"))) * 100"
minutes = 20
resolve_after_minutes = 20
tags = ["dpsre-managed", "dpse.temporal-onprem.prod.lv7.frontend.service-availability", "dpsre.temporal"]
conditions = {
"severe" = "100 - (sum(rate(ts(\"temporal-prod-lv7-frontend.service_errors*\"))) * 100/sum(rate(ts(\"temporal-prod-lv7-frontend.service_requests*\")))) > 25"
"warn" = "100 - (sum(rate(ts(\"temporal-prod-lv7-frontend.service_errors*\"))) * 100 /sum(rate(ts(\"temporal-prod-lv7-frontend.service_requests*\")))) > 15"
}
threshold_targets = { "severe" : "target:low", "warn" : "target:high" }
}
In the above shared example, the display expression and severe/warn expression are different. It should be same
The first part of the conditions is the display expression which should be common for both severe/warn/info/smoke. The conditions should only differ in values comparison (ex: > 90 is severe , > 70 is warn etc.) keeping the expression same.
Comments