Niklas Ye
d675f8ec9b
Like Team -> Switches, the page is now a table: a status badge (Active
if the key posted within a day, Quiet if it has but not lately, Never
used), when it last posted a webhook, when an alert last arrived on it,
how many distinct alerts it refreshed in the last 24 hours, and when it
was created. Adding a source moved into a "New source" sheet, and owners
can rename one from its row.
"Last alert" and the count needed alerts to remember which source they
came in on, which they never did, so migration 010 adds
alerts.integration_id and every accepted payload stamps it. Last sender
wins when two sources post the same fingerprint. It is not backfilled: a
NULL says "before this was recorded" rather than guessing, and it heals
by itself as Alertmanager re-sends each alert every repeat_interval.
Revoking a source keeps its alerts, unattributed.
Last webhook and last alert are separate on purpose: a payload with
nothing usable in it stamps the first and not the second. The Quiet
threshold is a fixed day, a colour and not an alarm, since silence that
should page is what dead man's switches are for.
The counts are indexed subqueries (alerts_integration_idx) rather than a
join, which would read every alert a source ever delivered.
API: the integrations list gains status, last_alert_at and alerts_24h,
and PATCH /api/teams/{id}/integrations/{id} renames. Both are additive;
terdut-tui needs nothing.
22 lines
1.2 KiB
SQL
22 lines
1.2 KiB
SQL
-- Which alert source an alert last arrived on.
|
|
--
|
|
-- Team -> Sources shows when each source last posted, which integrations
|
|
-- already knew (last_used_at, stamped on every webhook). What it could not say
|
|
-- was what a source delivered: an alert never recorded the key it came in on, so
|
|
-- "prod alertmanager" and "staging alertmanager" were indistinguishable once
|
|
-- inside. This column is that link, and lets the page show each source's last
|
|
-- alert and how many alerts it has kept fresh over the past day.
|
|
--
|
|
-- Last sender wins: every accepted payload restamps it, the way it advances
|
|
-- received_at. Two sources posting the same fingerprint into one team is
|
|
-- already one alert, and it is attributed to whichever spoke last.
|
|
--
|
|
-- Nullable, and not backfilled. Alerts that arrived before this migration have
|
|
-- no source, and NULL says so honestly rather than guessing. It heals by itself:
|
|
-- Alertmanager re-sends every alert each repeat_interval, and each re-send is an
|
|
-- accepted payload. Deleting a source keeps its alerts, unattributed.
|
|
ALTER TABLE alerts ADD COLUMN integration_id BIGINT REFERENCES integrations(id) ON DELETE SET NULL;
|
|
|
|
CREATE INDEX alerts_integration_idx ON alerts (integration_id, received_at)
|
|
WHERE integration_id IS NOT NULL;
|