Overview

Alert Shot is an enhanced processor for alert events. After an alert fires, it automatically captures a screenshot of the target page or monitoring dashboard according to the configuration and attaches the image to the alert, helping on-call engineers more intuitively assess the scope and severity of the issue.

Compared with text-only alerts, screenshots let frontline responders go from “identify the problem -> locate the context -> assess the blast radius” much faster.

Core Value

1. Lower the cost of understanding alerts

After receiving an alert, you can directly see a snapshot of the key page without manually opening the system to confirm the live state.

2. Improve collaboration efficiency

Screenshots provide unified context for IM, tickets, and post-mortems, reducing information loss in handoffs.

3. Shorten the incident-handling chain

Alert information and on-site visuals arrive together, helping on-call engineers decide whether to escalate more quickly.

Use Cases

Case 1: Business dashboard anomaly alert

Problem: when a core business metric triggers an alert, you want a screenshot of the business dashboard attached to the notification so you can quickly judge whether it is a global fluctuation.

Effect: on-call engineers can see the key chart trend directly in the notification, reducing back-and-forth between pages.

Case 2: Post-release quality patrol

Problem: an anomaly alert fires within the release window; you want the release monitoring page screenshot automatically attached to judge whether the issue is release-related.

Effect: quickly distinguish “release-induced fluctuation” from “external fluctuation” and improve handling accuracy.

Case 3: Cross-team troubleshooting

Problem: when an alert is escalated across teams, the receiving party lacks unified on-site information.

Effect: screenshots sync the on-site state at the same time-point to relevant teams, reducing communication cost.

Configuration Steps

Step 1: Add a Shot processor

• Open the Alert -> Event Pipelines menu and create a new pipeline
• Select “Alert Shot” as the processor type

Step 2: Configure screenshot parameters

2.1 Screenshot target

• Dashboard: screenshot of a monitoring dashboard page (template variables supported).
• URL type: screenshot of a regular page. Headers can be set if needed (for auth, etc.).

2.2 Variable rendering

You can reference alert-context variables in the URL / dashboard link.

All fields and labels of the alert event can be referenced. Common variables:

Variable	Description
{{$event.rule_name}}	The current alert rule name
{{$event.rule_id}}	The current alert rule id
{{$event.datasource_id}}	The alert datasource id

If the alert carries label information, you can reference labels, for example:

Variable	Description
{{$labels.cluster}}	The cluster this alert belongs to
{{$labels.service}}	The service this alert belongs to
{{$labels.instance}}	The alert instance (host / Pod)
{{$labels.namespace}}	The alert namespace
{{$labels.region}}	The alert region label
{{$labels.env}}	The alert environment label (prod/staging, etc.)

2.3 Screenshot timeout

• Timeout: maximum time for a single screenshot task; treated as failure on timeout
• Screenshot timeouts do not affect alert message delivery

Supported Notification Channels

Sending alert screenshots depends on the notification channel supporting image messages. Currently, the following notification channels support delivering alert screenshots:

• flashduty
• DingTalk group bot
• Feishu group bot
• WeCom group bot
• DingTalk app
• Feishu app

Best Practices

1. One rule corresponds to one type of screenshot target

Split “business overview screenshot” and “service detail screenshot” into multiple processors for easier maintenance and troubleshooting.

2. Mind access permissions

Make sure the screenshot service has access to the target page; otherwise you’ll get blank pages or login-page screenshots.

3. Combine with other processors

Can be combined with Relabel, Inhibit, label enrichment, etc.: normalize labels first, then take screenshots to enrich alert context.

FAQ

Q1: Will screenshot processing affect alert delivery latency?

A: It will have some impact. Recommendations: set a reasonable timeout (do not configure it too long to avoid hurting alert timeliness), control the number of screenshots, and optimize target page load speed to reduce extra latency.

Q2: Which alerts are suitable for screenshots?

A: We recommend prioritizing alerts that need “trends/context” — e.g. business fluctuations, release quality, core link health, etc.