Jsonata configuration guidelines

Concert Operate events need to define a stable deduplication for all events which is used to inform the construction of the Concert Operate alert. Alerts are derived from the events, and have lifetimes associated with them, hence the requirement for stable deduplication keys.

For example, if you want to model an alert when the CPU usage for the host london.ibm.com exceeds 95%. The deduplication key is built from three keys in the event:

• the whole payload in the resource payload, in this case resource.hostname: london.ibm.com The whole of the payload in the resource means every key value pair in that resource payload will be used to calculate the deduplication key.

• the type.classification, in this case type.classification:"threshold breach"

• the type.condition, in this case type.condition:"cpu breached 95%"

It is important that you keep the deduplicationKey stable for the lifetime of the event.

type.eventType describes whether the event is a problem or a resolution. So in this case, when the threshold breach occurs you need to set the type:event to problem. Once it is cleared, you need to set it to resolution.

There may be times where you may not naturally get clearing events from the source, for example a change event. It may indicate that the server has restarted. In such situations you need to set expirySeconds so that the alert gets cleared eventually and closed.

This covers grouping of alerts. For example, not only do you have a cpu threshold breach on your server london.ibm.com, but an application residing on that host also has a response time that has exceeded some set threshold. You may want to group alerts that are on the same host together. In this example, that would be london.ibm.com. So you would need to set resource.name: london.ibm.com.

By default, Concert Operate correlates all alerts with the same resource.name field that occur within 15 minutes of each other. It is therefore very important that the resource.name is set appropriately. resource.name should be chosen carefully so that it does not lead to large groups with little value. So for example we should avoid setting it to node or java.

Firstly the preference is to use the Instana integration 4.10 onwards. But if there is a need to implement a webhook integration for Instana, here are some guidelines:

• For deduplication the Instana eventId should be set for the payload value resource.eventId, this is to aid the uniqueness of the Concert Operate alert.

• In terms of topology correlation the resource.sourceId should be set to the Instana snapshotId. For resource based correlation set resource.name to the snapshotId.

• There are sample JSONata for Turbonomics that can be obtained from the Concert Operate UI when provisioning an instance of the generic integration.

(
 {
  "sender": {
     "service": issue.service,
     "name": "Instana Webhook",
     "type": "Webhook Connector"
 },
  "links": [
 {
     "url": issue.link
 }
 ],
  "resource": {
     "name": issue.entityType = "Redis Node" or issue.entityType = "Elasticsearch Node" ? issue.fqdn : issue.zone & ":" & issue.entityLabel,
     "hostname": issue.customPayloads."custom:Hostname"[0],
     "ipAddress": issue.customPayloads."custom:IP"[0],
  "application": issue.application,
  "location": issue.location,
     "type": issue.entity,
     "sourceId": $match (issue.link,/snapshotId=([^&]+)/)[0].groups[0],
     "cluster": issue.zone,
     "accessScope": issue.customPayloads."custom:Namespace"[0]
 },
  "type": {
     "classification": issue.entityType,
     "eventType": issue.state = "OPEN" ? "problem":"resolution"
  },
  "severity": issue.severity = 10 ? 6 : issue.severity = 5 ? 3 : issue.severity,
  "summary": issue.zone & ":" & issue.entityLabel & ":" & issue.text,
  "occurrenceTime": issue.start
 }
)

You can set the expiry time for alarms that are not getting coresponding clear alarms. In the following example for Turbonomic alarms, 'expirySeconds' is set to 1500.

(
 {
  "severity": risk.severity = "MINOR" ? 3 : risk.severity = "MAJOR" ? 4 : risk.severity = "CRITICAL" ? 6 : risk.severity= "UNKNOWN" ? 1 : 2,
  "summary": details,
  "expirySeconds": 1500,
  "links": [
  {
     "url": "https://company.customer.turbonomic.ibmappdomain.cloud/app/index.html#/view/main/action/" & uuid
  }
  ],
  "resource": {
     "name": target.aspects.containerPlatformContextAspect.namespace & "/" & target.displayName,
     "sourceId": target.uuid,
     "cluster": target.aspects.containerPlatformContextAspect.containerPlatformCluster
  },
  "type": {
     "classification": target.className,
     "eventType": $contains(details,"Resize down")?"resolution":actionState = "CLEARED" ? "resolution":actionState = "SUCCEEDED" ? "resolution" : "problem",
     "condition": risk.subCategory
  },
  "sender": {
     "name": "IBM Turbonomic - Workload Controller",
     "type": "Webhook Connector"
  }
 }
)