Skip to content

Commit b249ff9

Browse files
pijiang3pijiang3
committed
docs: add Sumo Logic alert integration guide
1 parent b64ab3f commit b249ff9

4 files changed

Lines changed: 239 additions & 0 deletions

File tree

‎docs.json‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1681,6 +1681,7 @@
16811681
"zh/on-call/integration/alert-integration/alert-sources/grafana",
16821682
"zh/on-call/integration/alert-integration/alert-sources/datadog",
16831683
"zh/on-call/integration/alert-integration/alert-sources/new-relic",
1684+
"zh/on-call/integration/alert-integration/alert-sources/sumo-logic",
16841685
"zh/on-call/integration/alert-integration/alert-sources/zabbix",
16851686
"zh/on-call/integration/alert-integration/alert-sources/flashcat",
16861687
"zh/on-call/integration/alert-integration/alert-sources/open-falcon",
@@ -3051,6 +3052,7 @@
30513052
"en/on-call/integration/alert-integration/alert-sources/grafana",
30523053
"en/on-call/integration/alert-integration/alert-sources/datadog",
30533054
"en/on-call/integration/alert-integration/alert-sources/new-relic",
3055+
"en/on-call/integration/alert-integration/alert-sources/sumo-logic",
30543056
"en/on-call/integration/alert-integration/alert-sources/zabbix",
30553057
"en/on-call/integration/alert-integration/alert-sources/flashcat",
30563058
"en/on-call/integration/alert-integration/alert-sources/open-falcon",

‎en/on-call/integration/alert-integration/alert-sources/sumo-logic.mdx‎

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
---
2+
title: "Sumo Logic alert integration"
3+
description: "Send Sumo Logic Monitor alert and recovery events to Flashduty On-call through a webhook."
4+
keywords: ["alert integration", "Sumo Logic", "Monitor", "webhook", "AlertResponseId"]
5+
---
6+
7+
Use a Sumo Logic webhook to send Monitor alerts to Flashduty On-call. Each Sumo Logic alert response maps to one Flashduty alert. Trigger, update, and recovery notifications in the same lifecycle continue updating that alert.
8+
9+
<div className="hide">
10+
11+
## In Flashduty On-call
12+
---
13+
14+
Create either a dedicated or shared **Sumo Logic** alert integration and copy its complete Push URL.
15+
16+
</div>
17+
18+
## Configure Sumo Logic
19+
---
20+
21+
<Steps>
22+
<Step title="Create a webhook connection">
23+
24+
1. In the new UI, go to **Monitoring → Connections**. In the classic UI, go to **Manage Data → Monitoring → Connections**
25+
2. Click **+ Add** and select **Webhook** as the connection type
26+
3. Name the connection `Flashduty`
27+
4. Paste the complete Flashduty integration Push URL into **URL**
28+
29+
</Step>
30+
31+
<Step title="Configure alert and recovery payloads">
32+
33+
Paste the same JSON into both **Alert Payload** and **Recovery Payload**:
34+
35+
```json
36+
{
37+
"alert_response_id": "{{AlertResponseId}}",
38+
"monitor_id": "{{Id}}",
39+
"alert_name": "{{AlertName}}",
40+
"name": "{{Name}}",
41+
"description": "{{Description}}",
42+
"monitor_type": "{{MonitorType}}",
43+
"detection_method": "{{DetectionMethod}}",
44+
"trigger_type": "{{TriggerType}}",
45+
"trigger_time_start": "{{TriggerTimeStart}}",
46+
"trigger_time_end": "{{TriggerTimeEnd}}",
47+
"trigger_condition": "{{TriggerCondition}}",
48+
"trigger_value": "{{TriggerValue}}",
49+
"alert_group": "{{AlertGroup}}",
50+
"query": "{{Query}}",
51+
"query_url": "{{QueryURL}}",
52+
"source_url": "{{SourceURL}}",
53+
"alert_response_url": "{{AlertResponseUrl}}"
54+
}
55+
```
56+
57+
Keep `alert_response_id` and `trigger_type`, and use the same payload for alert and recovery notifications. Flashduty rejects a missing `alert_response_id` because later updates and recovery cannot otherwise be correlated reliably.
58+
59+
</Step>
60+
61+
<Step title="Attach the connection to a monitor">
62+
63+
Create or edit a Monitor, select the `Flashduty` connection in its notification settings, and enable both alert and recovery notifications.
64+
65+
</Step>
66+
67+
<Step title="Verify the lifecycle">
68+
69+
Make the Monitor cross its threshold and confirm an active Flashduty alert. Then return the data to normal and confirm that the original alert recovers. The connection test button proves webhook connectivity only, not real lifecycle correlation.
70+
71+
</Step>
72+
</Steps>
73+
74+
## Alert Key
75+
---
76+
77+
Flashduty uses `AlertResponseId` directly as the Alert Key. Sumo Logic defines it as the unique identifier of the triggered alert. A real Monitor test also confirmed that a `Critical` trigger and its `ResolvedCritical` recovery carry the same `AlertResponseId`.
78+
79+
`Id` identifies the Monitor. A grouped Monitor can produce independent alerts, so the Monitor ID is stored only as context and is not used by itself as the Alert Key. Changes to the title, severity, time range, trigger value, or `AlertGroup` do not change the Alert Key.
80+
81+
## Status and severity
82+
---
83+
84+
| Sumo Logic `TriggerType` | Flashduty status or severity |
85+
| :--- | :--- |
86+
| `Critical` | Critical |
87+
| `Warning` | Warning |
88+
| `Missing Data` | Warning |
89+
| `Normal` | Recovered |
90+
| `ResolvedCritical` | Recovered; original severity Critical |
91+
| `ResolvedWarning` | Recovered; original severity Warning |
92+
| `ResolvedMissingData` | Recovered; original severity Warning |
93+
94+
An empty or unknown `TriggerType` is rejected so that an ambiguous request cannot enter the wrong alert lifecycle.
95+
96+
## Labels
97+
---
98+
99+
Flashduty stores the Monitor ID, Monitor type, detection method, `TriggerType`, trigger time range, condition and value, `AlertGroup`, query, and Sumo Logic links. `ResultsJson` is not sent by default, avoiding large and high-cardinality query results in labels.
100+
101+
## Troubleshooting
102+
---
103+
104+
- **Sumo Logic receives a non-2xx response**: verify that the full Push URL includes `integration_key`
105+
- **Flashduty reports an invalid parameter**: verify valid JSON and non-empty `alert_response_id` and `trigger_type` fields
106+
- **The alert does not recover**: configure the Recovery Payload and enable recovery notifications on the Monitor
107+
- **Grouped alerts overwrite each other**: use `{{AlertResponseId}}`; do not replace it with `{{Id}}`
108+
- **The test succeeds but real alerts do not arrive**: verify that the Monitor is enabled, its threshold is actually crossed, and it uses this connection
109+
110+
See [Sumo Logic Alert Variables](https://www.sumologic.com/help/docs/alerts/monitors/alert-variables/) and [Webhook Connections](https://www.sumologic.com/help/docs/alerts/webhook-connections/set-up-webhook-connections/) for the vendor field definitions and connection workflow.

‎integration-docs/src/doc-map.mjs‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,7 @@ export const docMap = {
6565
KSCloudMonitor: `${alertBase}/kscloud-monitor.mdx`,
6666
Datadog: `${alertBase}/datadog.mdx`,
6767
NewRelic: `${alertBase}/new-relic.mdx`,
68+
SumoLogic: `${alertBase}/sumo-logic.mdx`,
6869
AliyunPrometheus: `${alertBase}/aliyun-prometheus.mdx`,
6970
AliyunDataWorksOp: `${alertBase}/aliyun-dataworks-op.mdx`,
7071
HttpPull: `${alertBase}/http-pull.mdx`,

‎zh/on-call/integration/alert-integration/alert-sources/sumo-logic.mdx‎

Lines changed: 126 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,126 @@
1+
---
2+
title: "Sumo Logic 告警集成"
3+
description: "通过 Webhook 将 Sumo Logic Monitor 的触发和恢复事件同步到 Flashduty On-call。"
4+
keywords: ["告警集成", "Sumo Logic", "Monitor", "Webhook", "AlertResponseId"]
5+
---
6+
7+
通过 Sumo Logic Webhook 将 Monitor 告警同步到 Flashduty On-call。每个 Sumo Logic 告警响应对应一条 Flashduty 告警；同一次生命周期中的触发、更新和恢复会持续更新这条告警。
8+
9+
<div className="hide">
10+
11+
## 在 Flashduty On-call
12+
---
13+
14+
您可通过以下两种方式获取集成推送地址，任选其一即可。
15+
16+
### 使用专属集成
17+
18+
1. 进入 Flashduty 控制台，选择 **协作空间**，打开一个协作空间
19+
2. 选择 **集成数据**，点击 **添加一个集成**
20+
3. 选择 **Sumo Logic**，点击 **保存**
21+
4. 打开生成的集成卡片，复制 **推送地址**
22+
23+
### 使用共享集成
24+
25+
1. 进入 Flashduty 控制台，选择 **集成中心 → 告警事件**
26+
2. 选择 **Sumo Logic**，填写集成名称
27+
3. 配置默认路由并选择协作空间；创建后可在 **路由** 中增加更多规则
28+
4. 点击 **保存**，复制生成的 **推送地址**
29+
30+
</div>
31+
32+
## 在 Sumo Logic 中配置
33+
---
34+
35+
<Steps>
36+
<Step title="创建 Webhook Connection">
37+
38+
1. 在新版界面进入 **Monitoring → Connections**；经典界面进入 **Manage Data → Monitoring → Connections**
39+
2. 点击 **+ Add**，Connection Type 选择 **Webhook**
40+
3. 名称可填写 `Flashduty`
41+
4. 将 Flashduty 集成的完整推送地址粘贴到 **URL**
42+
43+
</Step>
44+
45+
<Step title="配置 Alert 和 Recovery Payload">
46+
47+
把下面的 JSON 同时粘贴到 **Alert Payload** 和 **Recovery Payload**：
48+
49+
```json
50+
{
51+
"alert_response_id": "{{AlertResponseId}}",
52+
"monitor_id": "{{Id}}",
53+
"alert_name": "{{AlertName}}",
54+
"name": "{{Name}}",
55+
"description": "{{Description}}",
56+
"monitor_type": "{{MonitorType}}",
57+
"detection_method": "{{DetectionMethod}}",
58+
"trigger_type": "{{TriggerType}}",
59+
"trigger_time_start": "{{TriggerTimeStart}}",
60+
"trigger_time_end": "{{TriggerTimeEnd}}",
61+
"trigger_condition": "{{TriggerCondition}}",
62+
"trigger_value": "{{TriggerValue}}",
63+
"alert_group": "{{AlertGroup}}",
64+
"query": "{{Query}}",
65+
"query_url": "{{QueryURL}}",
66+
"source_url": "{{SourceURL}}",
67+
"alert_response_url": "{{AlertResponseUrl}}"
68+
}
69+
```
70+
71+
<Warning>
72+
请保留 `alert_response_id` 和 `trigger_type`，并确保 Alert 与 Recovery 使用同一份 Payload。缺少 `alert_response_id` 时 Flashduty 会拒绝请求，因为无法可靠关联后续更新和恢复。
73+
</Warning>
74+
75+
</Step>
76+
77+
<Step title="关联 Connection 与 Monitor">
78+
79+
编辑或创建 Monitor，在通知设置中选择刚创建的 `Flashduty` Connection，并同时启用告警与恢复通知。
80+
81+
</Step>
82+
83+
<Step title="验证生命周期">
84+
85+
让 Monitor 真正进入阈值，确认 Flashduty 收到活动告警；再让指标或日志结果恢复正常，确认原告警恢复。Connection 的测试按钮只验证 Webhook 可达，不能证明真实告警生命周期可以关联。
86+
87+
</Step>
88+
</Steps>
89+
90+
## Alert Key
91+
---
92+
93+
Flashduty 直接使用 `AlertResponseId` 作为 Alert Key。Sumo Logic 官方将其定义为已触发告警的唯一标识；我们的真实 Monitor 验证也确认，`Critical` 触发与对应的 `ResolvedCritical` 恢复携带相同的 `AlertResponseId`。
94+
95+
`Id` 是 Monitor ID，一个 Monitor 在告警分组启用时可以产生多个独立告警，因此 `Id` 只作为标签，不能单独作为 Alert Key。标题、等级、时间范围、触发值和 `AlertGroup` 的变化都不会改变 Alert Key。
96+
97+
## 状态和告警等级
98+
---
99+
100+
| Sumo Logic `TriggerType` | Flashduty 状态或等级 |
101+
| :--- | :--- |
102+
| `Critical` | Critical |
103+
| `Warning` | Warning |
104+
| `Missing Data` | Warning |
105+
| `Normal` | 恢复 |
106+
| `ResolvedCritical` | 恢复，原等级为 Critical |
107+
| `ResolvedWarning` | 恢复，原等级为 Warning |
108+
| `ResolvedMissingData` | 恢复，原等级为 Warning |
109+
110+
空值或未知 `TriggerType` 会被拒绝，避免把无法判断状态的请求写入错误的告警生命周期。
111+
112+
## 标签
113+
---
114+
115+
Flashduty 会保存 Monitor ID、Monitor 类型、检测方法、`TriggerType`、触发时间范围、条件和值、`AlertGroup`、查询和 Sumo Logic 跳转链接。`ResultsJson` 默认不发送，避免把大体积、高基数查询结果写入标签。
116+
117+
## 排查问题
118+
---
119+
120+
- **Sumo Logic 返回非 2xx**：确认 Push URL 完整且包含 `integration_key`
121+
- **Flashduty 返回参数错误**：确认 Payload 是有效 JSON，且 `alert_response_id`、`trigger_type` 非空
122+
- **告警没有恢复**：确认填写了 Recovery Payload，并在 Monitor 中启用了恢复通知
123+
- **多个分组互相覆盖**：确认 Payload 使用 `{{AlertResponseId}}`，不要改成 `{{Id}}`
124+
- **测试成功但真实告警没收到**：检查 Monitor 是否启用、阈值是否真实命中，以及 Monitor 是否关联了该 Connection
125+
126+
更多字段含义请参阅 [Sumo Logic Alert Variables](https://www.sumologic.com/help/docs/alerts/monitors/alert-variables/) 和 [Webhook Connections](https://www.sumologic.com/help/docs/alerts/webhook-connections/set-up-webhook-connections/)。

0 commit comments

Comments
 (0)