Niklas Ye
f344bb707b
Each alert carries a generatorURL pointing at the Prometheus rule that fired it. The server now parses that link, queries the same Prometheus for the rule's expression and draws it under the alert, with the current value beside it. The browser never talks to Prometheus, so the CSP stays at connect-src 'self'. The URL comes out of a webhook payload, so whoever holds an integration key chooses it. Querying it is therefore opt-in and bounded by an allowlist, TERDUT_PROMETHEUS_ALLOWED_HOSTS (names, "*" as one label, a leading "**" as several, IPs, CIDRs). The check runs on the address the dialer is about to use, a name that resolves to loopback or link-local is refused even when it matches, and redirects and proxy variables are ignored. A worker takes a snapshot when an incident opens and another when it closes, so the graph outlives Prometheus' retention. It finds its work in the database rather than being triggered from the webhook, so ingestion is untouched and a restart loses nothing. While an incident is open the metrics endpoint also queries live, cached for 15 seconds. The rule expression keeps its threshold, so Prometheus returns data only while the alert condition holds; "no data" for the current value means the condition cleared. Stripping the threshold needs a PromQL parser and is left out. Claude-Session: https://claude.ai/code/session_016mBLURvJoMuUEr9cB2RpUN
52 lines
1.4 KiB
Go
52 lines
1.4 KiB
Go
package prom
|
|
|
|
import "sort"
|
|
|
|
// MaxSeriesPerAlert caps how many series are kept for one alert.
|
|
const MaxSeriesPerAlert = 5
|
|
|
|
// SelectSeries keeps the series that belong to this alert. The rule expression
|
|
// returns every series it matches, not just the one that fired, so a series is
|
|
// kept only if it agrees with the alert's labels on every label name they both
|
|
// carry. Labels only one side has (the rule's severity, the series' __name__)
|
|
// say nothing either way, and alertname is the rule's, not the series'.
|
|
//
|
|
// The result is capped at MaxSeriesPerAlert, best-labelled first: the more
|
|
// labels a series shares with the alert, the likelier it is the one that fired.
|
|
func SelectSeries(series []Series, alertLabels map[string]string) []Series {
|
|
type scored struct {
|
|
s Series
|
|
score int
|
|
}
|
|
var kept []scored
|
|
for _, s := range series {
|
|
score, ok := 0, true
|
|
for k, v := range s.Labels {
|
|
if k == "__name__" || k == "alertname" {
|
|
continue
|
|
}
|
|
av, has := alertLabels[k]
|
|
if !has {
|
|
continue
|
|
}
|
|
if av != v {
|
|
ok = false
|
|
break
|
|
}
|
|
score++
|
|
}
|
|
if ok && len(s.Points) > 0 {
|
|
kept = append(kept, scored{s, score})
|
|
}
|
|
}
|
|
sort.SliceStable(kept, func(i, j int) bool { return kept[i].score > kept[j].score })
|
|
if len(kept) > MaxSeriesPerAlert {
|
|
kept = kept[:MaxSeriesPerAlert]
|
|
}
|
|
out := make([]Series, len(kept))
|
|
for i, k := range kept {
|
|
out[i] = k.s
|
|
}
|
|
return out
|
|
}
|