Overview
The Event Drop processor is a flexible event filtering tool that allows you to decide whether to delete specific alert events based on custom logic conditions. When tag filtering and attribute filtering cannot meet your needs, you can use this processor to implement more complex filtering logic.
How It Works
The Event Drop processor uses Go Template syntax to write judgment logic:
- If the template execution result is
true
, the event is deleted - If the template execution result is
false
or other values, the event is retained
Configuration Method
1. Select Processor Type
In the alert rule configuration page, select “Event Drop” as the processor type.
2. Write Judgment Logic
In the judgment logic input box, use Go Template syntax to write your filtering conditions.
Available Variables
In the template, you can use the following predefined variables:
Variable | Description | Example Usage |
---|---|---|
$event |
The entire event object | $event.RuleName |
$labels |
Event label mapping | $labels.instance |
$value |
Trigger value | $value |
Usage Examples
Example 1: Filter by Label Value
{{ if eq $labels.service "mon" }}true{{ else }}false{{ end }}
This configuration will delete all events with the label service equal to “mon”.
Example 2: Filter by Trigger Value
{{ if lt $value 10 }}true{{ else }}false{{ end }}
This configuration will delete all events with trigger values less than 10.
Example 3: Filter by Instance Name
{{ if hasPrefix $labels.instance "test-" }}true{{ else }}false{{ end }}
This configuration will delete all events with instance names starting with “test-”.
Example 4: Combined Condition Filtering
{{ if and (eq $labels.env "dev") (lt $value 5) }}true{{ else }}false{{ end }}
This configuration will delete events where the environment is “dev” and the trigger value is less than 5.
Common Template Functions
Comparison Functions
eq
: Equal -{{ eq $value 100 }}
ne
: Not equal -{{ ne $labels.env "prod" }}
lt
: Less than -{{ lt $value 50 }}
le
: Less than or equal -{{ le $value 50 }}
gt
: Greater than -{{ gt $value 100 }}
ge
: Greater than or equal -{{ ge $value 100 }}
Logic Functions
and
: Logical AND -{{ and (eq $labels.env "prod") (gt $value 100) }}
or
: Logical OR -{{ or (eq $labels.env "dev") (eq $labels.env "test") }}
not
: Logical NOT -{{ not (eq $labels.env "prod") }}
String Functions
hasPrefix
: Prefix match -{{ hasPrefix $labels.instance "web-" }}
hasSuffix
: Suffix match -{{ hasSuffix $labels.instance "-prod" }}
contains
: Contains string -{{ contains $labels.message "error" }}
Testing Feature
After configuration, you can use the testing feature provided on the page to verify if your judgment logic is correct:
- Click the “Test” button
- View test results to confirm if they meet expectations
- Adjust judgment logic as needed
Troubleshooting
Common Issues
-
Template Parsing Failed
- Check if Go Template syntax is correct
- Confirm variable names are spelled correctly
-
Template Execution Failed
- Check if non-existent labels or attributes are used
- Confirm data types match
-
Events Not Deleted as Expected
- Confirm if template return value is the string “true”
- Use testing feature to verify logic
Debugging Suggestions
- Start testing with simple conditions
- Gradually increase complexity
- Check system logs to understand execution results
- Use testing feature to verify logic correctness
By properly using the Event Drop processor, you can achieve precise event filtering, reduce unnecessary alert noise, and improve the efficiency of your alert system.