Fields Description

System Default Fields Description ¶

Common ¶

Origin fields (in alert table) ¶

1. lastReceived: Last event receiving time.
2. firingStartTime: The firing alert event receiving time since last resolve.
3. firstFiringTime: The first firing alert event receiving time of the alert object in history.
4. startedAt: The first alert event receiving time of the alert object in history.
5. lastFiringTime: The last firing alert event receiving time of the alert object in history (alert coming with acknowledgment/pending status also treat as firing).
6. firingCount: The count of how many times firing-resolved life cycle has occurred. Set to 1 when the first firing alert comes, increased whenever an event moves from resolved to firing.
7. flapping_count: The count of how many times firing-resolved life cycle has occurred. Set to 1 when the first auto recover happens, increased when another round of auto recover happens, set to 0 when alert been set to pending/acknowledgment status.

Enriched fields (in alertenrichment table) ¶

1. assignTime: The time when the alert is assigned to someone.
2. assignee: The user who the alert is assigned to.
3. pendingTime: The time the alert been set as pending status.
4. pendingDuration: The total duration for each pending period(from pendingTime to alert status change to other).
5. pendingBy: The user who set the alert as pending status.
6. resolvedTime: The alert been resolved time.
7. totalResolvedDuration: The latest resolvedTime - firstFiringTime.
8. lastResolvedDuration: The latest resolvedTime - firingStartTime.
9. resolvedBy: The user who resolved the alert.

Emsv1 Provider ¶

1. lastAlertTime: The 'ts' value in alert body (no change if a resolved event coming, only change when a new firing event coming).
2. alertStartTime: The 'ts' value in alert body (set null if is resolved event).
3. firstAlertTime：The 'ts' value in first-ever alert body (never overwrite).
4. lastResolvedTime: The last 'firing' to 'resolved' ts.

Event lifecycle ¶