RuleType Spike: Number of events of current and reference timeframe in alerta alert.

[ulmako]

Hi,

I'm using the rule type Spike and send the alerts to alerta.

Since the an alert for the Spike type does not contain one single event, I want to send a summary in the alert containing information about the current timeframe and the reference timeframe (i.e. number of events in both timestamps)

If I understand the code correctly (code) , I can only use information from the first match with Python-like string syntax {<field>} in the fields.

Is it possible to also get information from the alert?

Thanks and regards
Ulrich

[jertel]

Have you tried using spike_count and reference_count from the match?

[ulmako]

This works! Thanks a lot.

I couldn't find the two values in the documentation. Is there a list with all the fields of a match?

[jertel]

I had to look at the source code to find those, and those are the only ones specific to spike rules. Feel free to submit a PR with a doc update to mention those. Thanks!

[ulmako]

#1542

[jertel]

Thank you!