Skip to main content

Notification filters overview

Notification filters control which events are delivered to a subscription.

Each subscription filter is evaluated against an event context with two top-level inputs:

  • event - the current notification event payload
  • computed - derived values used for matching, including current values, previous values, presence arrays, and historical maxima when available

What filters are for​

Use filters when you want a subscription to receive only a subset of notification events, for example:

  • only high-impact events
  • only events affecting specific nodes or metric types
  • only events where a value increased compared to the previous event
  • only events for a specific node and metric pair

Supported input groups​

The filter engine supports variables under these groups:

  • event.*
  • computed.*

At a high level, computed includes:

  • aggregate current and previous values for active metrics, active nodes, and impact
  • historical max values such as max_8h, max_24h, and max_lifetime
  • presence arrays for nodes, metric types, and node-metric pairs
  • severity values per node-metric pair

Example filters​

Filter by impact​

{
  ">=": [
    { "var": "computed.impact.current" },
    3
  ]
}

Filter by 24-hour peak impact​

{
  ">=": [
    { "var": "computed.impact.max_24h" },
    3
  ]
}

Filter by change compared to previous event​

{
  ">": [
    { "var": "computed.activeMetrics.current" },
    { "var": "computed.activeMetrics.prev" }
  ]
}

Combine multiple conditions​

{
  "and": [
    {
      ">=": [
        { "var": "computed.impact.current" },
        3
      ]
    },
    {
      "intersects": [
        { "var": "computed.nodesArray.present" },
        [101, 205]
      ]
    },
    {
      "or": [
        {
          ">": [
            { "var": "computed.activeMetrics.current" },
            { "var": "computed.activeMetrics.prev" }
          ]
        },
        {
          ">=": [
            { "var": "computed.impact.max_24h" },
            4
          ]
        }
      ]
    }
  ]
}

This example matches events that:

  • have current impact >= 3
  • affect node 101 or 205
  • and either show more active metrics than the previous event or reached impact 4 within the last 24 hours

Testing filters​

Use Test notification filter to evaluate a filter against an event before saving it to a subscription.

Notes​

  • Invalid filters are rejected when a subscription is created
  • Historical computed max values depend on notification stats collected during real execution