Deduplication
Occurrences of the same event are deduplicated into a single alert instance.
The default correlation policy constructs a deduplication key for events from the following elements:
{{ event.resource }}-{{ event.type.classification }}-{{ event.type.condition }}
When the same event occurs multiple times (the resource, classification, and condition fields are the same), then deduplication increments the event count of the current alert instance to show how many times the event occurred.
Problem events (type.eventType = problem) create an alert (if one does not exist). Meanwhile, resolution events (type.eventType = resolution) do not become alerts and are not visible in the Alert Viewer. They clear an
alert if one exists and ignore if none exists. For a resolution event to clear a problem alert instance, it must have the same deduplication key as the problem event that the alert was created from. Also, it must have occurred after the last
problem event that contributed to the alert.
Type fields and alert correlation
Since the same alert arises for all events with same type fields, these fields must clearly indicate the specific fault condition and have separate values for different conditions. The resource fields are important for both alert correlation
and topology lookups. Therefore, they must accurately describe the resource that exhibits the fault condition. By default, alerts with the same resource.name field that occur within 15 minutes of each other are correlated together.
Additionally, all resource fields are used to look up each alert in the topology. Therefore, where possible one or more of these fields must be in the same form as the match tokens for the corresponding topology resource.
Alerts are also correlated by using temporal correlation. Temporal correlation looks for historic patterns of co-occurrence and uses this information to predict future correlation. This correlation relies on consistent value of the type fields over time for the same conditions against the same resources. Therefore, the values of these fields must be deterministic.