Let’s say my elasticsearch returns from query multiple series.
Each record if breach the condition of alert will send message to slack. So having 20 series will give me 20 separate messages on slack. I’m wondering how to limit it? I know I can remove “Group by” from elasticsearch query but the thing is I want to include “Company.keyword” label into the slack message. Any ideas? Is it possible to do something like “latest” ?
You can group on the notification policy level by alertname. So you will receive one slack message for all 20 alerts.
Content of that message depends on used notification template used for Slack contact point.
I think you will have details about all alerts there by default. But I think that’s not safe, because Slack message size has probably some limit. So it will be good idea to have some logic for that in the notification template, e. g. print only first 3 alerts and then just add 3 dots to indicates that there is more alerts after them.
