夜莺-Nightingale
夜莺V7
项目介绍 功能概览
部署升级 部署升级
数据接入 数据接入
告警管理 告警管理
数据查看 数据查看
功能介绍 功能介绍
API FAQ
夜莺V6
项目介绍 架构介绍
快速开始 快速开始
黄埔营
安装部署 安装部署
升级
采集器 采集器
使用手册 使用手册
API API
数据库表结构 数据库表结构
FAQ FAQ
开源生态
Prometheus
版权声明
第1章:天降奇兵 第1章:天降奇兵
第2章:探索PromQL 第2章:探索PromQL
第3章:Prometheus告警处理 第3章:Prometheus告警处理
第4章:Exporter详解 第4章:Exporter详解
第5章:数据与可视化 第5章:数据与可视化
第6章:集群与高可用 第6章:集群与高可用
第7章:Prometheus服务发现 第7章:Prometheus服务发现
第8章:监控Kubernetes 第8章:监控Kubernetes
第9章:Prometheus Operator 第9章:Prometheus Operator
参考资料

Overview

The Event Drop processor is a flexible event filtering tool that allows you to decide whether to delete specific alert events based on custom logic conditions. When tag filtering and attribute filtering cannot meet your needs, you can use this processor to implement more complex filtering logic.

How It Works

The Event Drop processor uses Go Template syntax to write judgment logic:

  • If the template execution result is true, the event is deleted
  • If the template execution result is false or other values, the event is retained

Configuration Method

1. Select Processor Type

In the alert rule configuration page, select “Event Drop” as the processor type.

2. Write Judgment Logic

In the judgment logic input box, use Go Template syntax to write your filtering conditions.

Available Variables

In the template, you can use the following predefined variables:

Variable Description Example Usage
$event The entire event object $event.RuleName
$labels Event label mapping $labels.instance
$value Trigger value $value

Usage Examples

Example 1: Filter by Label Value

{{ if eq $labels.service "mon" }}true{{ else }}false{{ end }}

This configuration will delete all events with the label service equal to “mon”.

Example 2: Filter by Trigger Value

{{ if lt $value 10 }}true{{ else }}false{{ end }}

This configuration will delete all events with trigger values less than 10.

Example 3: Filter by Instance Name

{{ if hasPrefix $labels.instance "test-" }}true{{ else }}false{{ end }}

This configuration will delete all events with instance names starting with “test-”.

Example 4: Combined Condition Filtering

{{ if and (eq $labels.env "dev") (lt $value 5) }}true{{ else }}false{{ end }}

This configuration will delete events where the environment is “dev” and the trigger value is less than 5.

Common Template Functions

Comparison Functions

  • eq: Equal - {{ eq $value 100 }}
  • ne: Not equal - {{ ne $labels.env "prod" }}
  • lt: Less than - {{ lt $value 50 }}
  • le: Less than or equal - {{ le $value 50 }}
  • gt: Greater than - {{ gt $value 100 }}
  • ge: Greater than or equal - {{ ge $value 100 }}

Logic Functions

  • and: Logical AND - {{ and (eq $labels.env "prod") (gt $value 100) }}
  • or: Logical OR - {{ or (eq $labels.env "dev") (eq $labels.env "test") }}
  • not: Logical NOT - {{ not (eq $labels.env "prod") }}

String Functions

  • hasPrefix: Prefix match - {{ hasPrefix $labels.instance "web-" }}
  • hasSuffix: Suffix match - {{ hasSuffix $labels.instance "-prod" }}
  • contains: Contains string - {{ contains $labels.message "error" }}

Testing Feature

After configuration, you can use the testing feature provided on the page to verify if your judgment logic is correct:

  1. Click the “Test” button
  2. View test results to confirm if they meet expectations
  3. Adjust judgment logic as needed

Troubleshooting

Common Issues

  1. Template Parsing Failed

    • Check if Go Template syntax is correct
    • Confirm variable names are spelled correctly
  2. Template Execution Failed

    • Check if non-existent labels or attributes are used
    • Confirm data types match
  3. Events Not Deleted as Expected

    • Confirm if template return value is the string “true”
    • Use testing feature to verify logic

Debugging Suggestions

  1. Start testing with simple conditions
  2. Gradually increase complexity
  3. Check system logs to understand execution results
  4. Use testing feature to verify logic correctness

By properly using the Event Drop processor, you can achieve precise event filtering, reduce unnecessary alert noise, and improve the efficiency of your alert system.

快猫星云 联系方式 快猫星云 联系方式
快猫星云 联系方式
快猫星云 联系方式
快猫星云 联系方式
快猫星云
OpenSource
开源版
Flashcat
Flashcat