Overview

The Event Drop processor is a flexible event filtering tool that allows you to decide whether to delete specific alert events based on custom logic conditions. When tag filtering and attribute filtering cannot meet your needs, you can use this processor to implement more complex filtering logic.

How It Works

The Event Drop processor uses Go Template syntax to write judgment logic:

• If the template execution result is true, the event is deleted
• If the template execution result is false or other values, the event is retained

Configuration Method

1. Select Processor Type

In the alert rule configuration page, select “Event Drop” as the processor type.

2. Write Judgment Logic

In the judgment logic input box, use Go Template syntax to write your filtering conditions.

Available Variables

In the template, you can use the following predefined variables:

Usage Examples

Example 1: Filter by Label Value

{{ if eq $labels.service "mon" }}true{{ else }}false{{ end }}

This configuration will delete all events with the label service equal to “mon”.

Example 2: Filter by Trigger Value

{{ if lt $value 10 }}true{{ else }}false{{ end }}

This configuration will delete all events with trigger values less than 10.

Example 3: Filter by Instance Name

{{ if hasPrefix $labels.instance "test-" }}true{{ else }}false{{ end }}

This configuration will delete all events with instance names starting with “test-”.

Example 4: Combined Condition Filtering

{{ if and (eq $labels.env "dev") (lt $value 5) }}true{{ else }}false{{ end }}

This configuration will delete events where the environment is “dev” and the trigger value is less than 5.

Common Template Functions

Comparison Functions

• eq: Equal - {{ eq $value 100 }}
• ne: Not equal - {{ ne $labels.env "prod" }}
• lt: Less than - {{ lt $value 50 }}
• le: Less than or equal - {{ le $value 50 }}
• gt: Greater than - {{ gt $value 100 }}
• ge: Greater than or equal - {{ ge $value 100 }}

Logic Functions

• and: Logical AND - {{ and (eq $labels.env "prod") (gt $value 100) }}
• or: Logical OR - {{ or (eq $labels.env "dev") (eq $labels.env "test") }}
• not: Logical NOT - {{ not (eq $labels.env "prod") }}

String Functions

• hasPrefix: Prefix match - {{ hasPrefix $labels.instance "web-" }}
• hasSuffix: Suffix match - {{ hasSuffix $labels.instance "-prod" }}
• contains: Contains string - {{ contains $labels.message "error" }}

Testing Feature

After configuration, you can use the testing feature provided on the page to verify if your judgment logic is correct:

1. Click the “Test” button
2. View test results to confirm if they meet expectations
3. Adjust judgment logic as needed

Troubleshooting

Common Issues

1. Template Parsing Failed

   • Check if Go Template syntax is correct
   • Confirm variable names are spelled correctly

2. Template Execution Failed

   • Check if non-existent labels or attributes are used
   • Confirm data types match

3. Events Not Deleted as Expected

   • Confirm if template return value is the string “true”
   • Use testing feature to verify logic

Debugging Suggestions

1. Start testing with simple conditions
2. Gradually increase complexity
3. Check system logs to understand execution results
4. Use testing feature to verify logic correctness

By properly using the Event Drop processor, you can achieve precise event filtering, reduce unnecessary alert noise, and improve the efficiency of your alert system.