From ee545c4c0f15061da8cb4ad96265a5af89c3a05c Mon Sep 17 00:00:00 2001 From: "flashduty[bot]" Date: Wed, 14 Oct 2026 08:37:35 +0000 Subject: [PATCH 1/2] =?UTF-8?q?docs:=20doc-review=202026-10-14=20=E2=80=94?= =?UTF-8?q?=20investigation=20entries,=20alert-aggregation=20rework,=20lab?= =?UTF-8?q?el=20panel,=20dashboard=20and=20RUM=20remote-config=20drift?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Window: 2026-10-13T08:11:02Z .. 2026-10-14T08:11Z (diff mode, 23 repos scanned). 42 findings (3 high / 31 medium / 8 low); 37 pages edited (zh + en), 1 new page (monitors/alert-rules/investigation-entries) registered in docs.json. --- docs.json | 6 +- en/ai-sre/im.mdx | 8 +- en/changelog/changelog.mdx | 33 +++ en/developer/go-sdk.mdx | 2 +- en/monitors/alert-rules/active-alerts.mdx | 1 + .../alert-rules/investigation-entries.mdx | 200 ++++++++++++++++++ en/monitors/dashboards/dashboards.mdx | 20 +- en/monitors/explore/explore.mdx | 17 +- en/monitors/quickstart/quickstart.mdx | 21 +- en/on-call/channel/create-edit.mdx | 31 ++- en/on-call/channel/noise-reduction.mdx | 61 ++++-- .../configuration/filter-conditions.mdx | 6 +- en/on-call/configuration/schedule.mdx | 6 +- en/on-call/incident/alert-management.mdx | 10 +- en/on-call/incident/search-view-incident.mdx | 39 +++- en/on-call/incident/what-is-incident.mdx | 52 ++++- .../alert-integration/routing-rules.mdx | 16 +- en/platform/team-members.mdx | 4 +- en/rum/quickstart/app-management.mdx | 9 +- en/rum/sdk/harmony/advanced-config.mdx | 51 ++++- zh/ai-sre/im.mdx | 8 +- zh/changelog/changelog.mdx | 33 +++ zh/developer/go-sdk.mdx | 2 +- zh/monitors/alert-rules/active-alerts.mdx | 1 + .../alert-rules/investigation-entries.mdx | 200 ++++++++++++++++++ zh/monitors/dashboards/dashboards.mdx | 20 +- zh/monitors/explore/explore.mdx | 17 +- zh/monitors/quickstart/quickstart.mdx | 21 +- zh/on-call/channel/create-edit.mdx | 31 ++- zh/on-call/channel/noise-reduction.mdx | 61 ++++-- .../configuration/filter-conditions.mdx | 6 +- zh/on-call/configuration/schedule.mdx | 6 +- zh/on-call/incident/alert-management.mdx | 10 +- zh/on-call/incident/search-view-incident.mdx | 41 +++- zh/on-call/incident/what-is-incident.mdx | 54 ++++- .../alert-integration/routing-rules.mdx | 16 +- zh/platform/team-members.mdx | 4 +- zh/rum/quickstart/app-management.mdx | 8 +- zh/rum/sdk/harmony/advanced-config.mdx | 51 ++++- 39 files changed, 1047 insertions(+), 136 deletions(-) create mode 100644 en/monitors/alert-rules/investigation-entries.mdx create mode 100644 zh/monitors/alert-rules/investigation-entries.mdx diff --git a/docs.json b/docs.json index c1ceeff1d..c500a15b1 100644 --- a/docs.json +++ b/docs.json @@ -3855,7 +3855,8 @@ "zh/monitors/alert-rules/tencent-cls", "zh/monitors/alert-rules/victorialogs", "zh/monitors/alert-rules/query-result-fields", - "zh/monitors/alert-rules/description-template" + "zh/monitors/alert-rules/description-template", + "zh/monitors/alert-rules/investigation-entries" ] }, { @@ -5605,7 +5606,8 @@ "en/monitors/alert-rules/tencent-cls", "en/monitors/alert-rules/victorialogs", "en/monitors/alert-rules/query-result-fields", - "en/monitors/alert-rules/description-template" + "en/monitors/alert-rules/description-template", + "en/monitors/alert-rules/investigation-entries" ] }, { diff --git a/en/ai-sre/im.mdx b/en/ai-sre/im.mdx index 60c8f4b48..66af62053 100644 --- a/en/ai-sre/im.mdx +++ b/en/ai-sre/im.mdx @@ -76,13 +76,13 @@ Once the bot has your message, it first puts an emoji reaction on **the message | Platform | Emoji pool (one picked at random) | | --- | --- | -| Slack | eyes, thinking_face, hourglass_flowing_sand, mag, zap | -| Lark / Feishu | Typing, THINKING, Get, OnIt | -| DingTalk | Platform built-in emotions: 思考, 收到, Get | +| Slack | eyes, hourglass_flowing_sand | +| Lark / Feishu | Typing, OneSecond | +| DingTalk | Platform built-in emotions: 专注, 忙疯了 | On Slack this sits alongside a native "is working on it" status, which the bot also shows. -The reaction is removed once the answer is delivered. A single failed removal, such as a platform hiccup or rate limit, doesn't leave the emoji on the message forever. The next successful delivery retries the removal with **the exact emoji that was added**, so stuck receipts eventually clear. +The reaction is removed once the answer is delivered. A single failed removal, such as a platform hiccup or rate limit, doesn't leave the emoji on the message forever. The next successful delivery retries the removal with **the exact emoji that was added**, so stuck receipts eventually clear. Receipts added before per-message bookkeeping have no record of which emoji was used; those are retried with the platform's fixed fallback value (eyes on Slack, Typing on Feishu, 思考 on DingTalk). WeCom has no emoji API, so its "processing" receipt is a placeholder message, such as a random "On it…". The task checklist card and the final answer then replace it in place. diff --git a/en/changelog/changelog.mdx b/en/changelog/changelog.mdx index 741fff380..33d89c7ef 100644 --- a/en/changelog/changelog.mdx +++ b/en/changelog/changelog.mdx @@ -4,6 +4,39 @@ description: "This page documents important updates and feature releases for Fla keywords: ["Changelog", "Product Release", "Feature Updates", "Flashduty", "Version History"] --- + + +### Investigation entries: from an alert straight to a dashboard or the Query Workbench + +The alert-rule form gains a **sixth** block, **Investigation entries**: a rule can carry up to **20** jump targets, each one either an **Add dashboard entry** (pick a dashboard, set **Open at** to the whole dashboard / a tab / a group / a panel, and fill the dashboard variables' **variable values**) or an **Add query entry** (data source + query type + query statements + query parameters; leave the data source empty to use the alert event's own data source). Each entry takes a **purpose** (one line saying what it helps confirm) and a **time range** (how many minutes before and after the alert; both must be non-negative and their sum must be greater than 0), and entries can be dragged into a display order. Variable values render as Go templates whose context is only `$labels` (the alert's raw data labels, without rule-appended labels) and `$datasource` (the event data source's id / name / type / address); the query is rendered verbatim, never auto-quoted or escaped, and query parameters are not templated at all. **Preview link** then picks a live alert of the rule so you can try the jump before relying on it. + +Once the configuration is in effect, the right column of an incident or alert produced by a Monit alert rule shows an **Investigation Entries** block after **Attributes**: the entries come from the event's snapshot (the first 3 by default, the rest behind "N more"), each with its purpose, data source, variables and query time range, followed by the **alert rule** with its **main / related queries** — the values at trigger time, the results and the full expression. The same entries also appear behind the **Investigate** popover on every related-alert row and in the Monit active-alert detail drawer. The block is built from the event snapshot rather than the rule's current configuration, so editing a rule does not change the entries of alerts it already produced, and alerts accepted before the configuration took effect show none at all. Self-hosted deployments should note the version requirement: saving a rule that carries entries requires **every** registered monit-edge in the clusters of the data sources the rule matches to be `v0.75.3` or later, and saving is rejected otherwise; when a snapshot fails to render, the panel says why in place (rule deleted / Edge upgrade required / invalid configuration / content over 8KB). See [Alert rules · Investigation entries](/en/monitors/alert-rules/investigation-entries) and [Search and view incidents](/en/on-call/incident/search-view-incident). + +### Alert grouping: a three-way choice, configurable while you create the channel + +Alert grouping turns from an on/off switch with two modes into three mutually exclusive cards — **Intelligent grouping** / **Rule-based grouping** / **No grouping** — each with a one-line description and the currently effective one flagged **Default**: intelligent grouping "decides by how similar the titles, descriptions and label content are", rule-based grouping means "alerts with the same field values join one incident, with an explicit and previewable result", and no grouping means "one incident per alert, never joining an existing one". Availability now follows the plan: **Intelligent grouping** needs Professional or higher (selectable by default on-premises), **Rule-based grouping** needs Standard or higher, and Free gets **No grouping** only; a card out of reach is greyed out with the tooltip "your current subscription does not support this grouping method". + +The create-channel wizard gains a **fourth** step, **Alert Grouping**, so a new channel is grouped from the moment it exists: the method is preselected per plan (Professional and on-premises → Intelligent grouping, Standard → Rule-based grouping, Free → No grouping), and you can adjust the **Grouping fields** (rule-based) or the **Information used for matching** (intelligent), the **Grouping duration** (**Until the incident closes** / **Fixed 60 minutes**), and, under **Advanced**, **Strict mode**, **Information used for matching** and **Storm warning**. Rule-based grouping's two sub-options are renamed to **Use one rule for all alerts** / **Use different rules for different alerts**, and the fallback dimension becomes **When no rule matches**: group by the default fields below, and leave them empty to disable grouping. A new channel also enables flapping detection in **Alert Only** mode by default, with a 60-minute window and 4 state changes. See [Noise reduction](/en/on-call/channel/noise-reduction) and [Create and manage](/en/on-call/channel/create-edit). + +### Label panel redesign: system labels tucked away, links moved to the top + +The label panel on incident and alert details renders differently. **Hide Meta Label** becomes **Hide system labels** / **Show system labels** (with an eye icon) and recognises system labels per source, collapsed by default: a Monit alert treats only the `__alert_rule_` / `__entity_alert_` prefixes as system labels, while other sources keep the `__...__` sandwich plus the `__alert_rule_` / `__entity_alert_` / `__flashduty_` prefixes. While collapsed, a dashed hint at the bottom of the list reads "N system labels collapsed (first few keys…)"; expanding it shows a separate **System Labels** section (excluded from drag sorting), and the count next to the title is now the total number of labels. + +Labels whose value is an http(s) link and not an image no longer stay in the list — they move into a **Related Links** button bar above it, the button name mapped from the key (View source / Runbook / Silence / Open dashboard / Open panel / View query / View logs / View alert / View rule / Alert history), with unlisted keys falling back to "key · domain". Label values gain four renderings: an image link shows a thumbnail (click to open the full image), `arn:...` shows the resource segment with service and region, timestamps are formatted in the account time zone with an "x ago" suffix, and query keys (promql / logql / query / sql and similar) render as a monospace code block. Hovering a system label's value opens a hover card that translates machine labels — alert rule id, folder, data source, event type — into plain words with a link to jump. The old per-label **Explore** icon is gone: to open the query an alert fired with, use the system label's hover card, the **Investigation Entries** block on the right of the detail page, or the **Investigate** popover on a related-alert row. See [What is an incident](/en/on-call/incident/what-is-incident#incident-labels) and [Search and view incidents](/en/on-call/incident/search-view-incident). + +### Scheduled Notification: daily, weekly or monthly + +**Scheduled Notification** on a rotation is no longer daily-only: the cycle is **Daily / Weekly / Every month**, weekly multi-selects weekdays and monthly multi-selects the day of the month (1–31), and the notification still goes out at HH:MM on the chosen days in the schedule's time zone. A month without the chosen day (pick the 31st and meet a 30-day month) simply sends nothing that month, and a weekly or monthly cycle needs at least one day selected before it can be saved. See [Schedule](/en/on-call/configuration/schedule). + +### Dashboards: global search, panel query mode and template checks + +The dashboard list page gains a **Global search** at the top right: it searches dashboards across every folder the account can read (permission is filtered server-side), matches title or description, takes several keywords separated by spaces, labels each result with its folder path so duplicate titles can be told apart, shows 20 per page and offers a retry on failure. Its search state lives only inside the dialog — it neither affects the list page's "search the current folder" nor is written into the page address. + +In the panel editor's query **Options**, a Loki **table** or **stat** panel now lets you choose the **Query mode** yourself: **Range** computes point by point along the step to draw a trend, **Instant** computes a single value over the whole time range (`[$__auto]` takes the whole range) — table defaults to instant and stat to range. Loki time series stay fixed at range, and Loki instant does not accept a **min step**. Query-type template variables now get a form shaped by the data source: MySQL writes SQL, Loki fills a stream selector plus a label name, and other data sources use the Prometheus label form. The query is now pre-checked in the editor for the three patterns the backend refuses on save — a multi-select or "all" variable inside an exact matcher, a reference to an undefined variable, and a built-in variable unavailable for the current data source and query mode — and the exact-matcher one comes with a one-click **Switch to regex match**. **Preview candidates** now runs with the current variable selections and the panel's time range, so the preview matches what the dashboard actually renders. See [Dashboards](/en/monitors/dashboards/dashboards). + + + + ### AI SRE automations gain a War room created trigger diff --git a/en/developer/go-sdk.mdx b/en/developer/go-sdk.mdx index 10ab8bb0c..ec2d19cc3 100644 --- a/en/developer/go-sdk.mdx +++ b/en/developer/go-sdk.mdx @@ -278,7 +278,7 @@ zero := inc.StartTime.IsZero() // whether it's the unset sentinel `AlertRuleV2`'s `investigation_targets` (the same return type of `AlertRules.ReadInfoV2` / `WriteCreateV2` / `WriteUpdateV2`) changed shape as well, so callers still sending the old fields have to migrate: -- The field itself is `[]InvestigationTarget`, at most 20 entries with no duplicates; on the update endpoint it is presence-based — omitting it keeps the saved configuration, sending `[]` clears it. Each entry may carry an optional `purpose`: one-sentence plain text saying what the entry helps confirm (≤512 bytes; literal text, not a template, and not part of alert identity). +- The field itself is `[]InvestigationTarget`, at most 20 entries with no duplicates, and the serialized list must not exceed **32 KiB** (`MaxInvestigationTargetsBytes = 32 * 1024`; exceeding it returns `investigation_targets must not exceed 32768 bytes`). On the update endpoint it is presence-based — omitting it keeps the saved configuration, sending `[]` clears it. Each entry may carry an optional `purpose`: one-sentence plain text saying what the entry helps confirm (**do not put line breaks in it**; the server validates ≤512 bytes and requires valid UTF-8 with no control characters, while the console caps the input at 200 characters, so the API accepts somewhat more than the console, but 200 CJK characters can already exceed 512 bytes). `purpose` is literal text, not a template, and is not part of alert identity or de-duplication. - Each entry is a **closed tagged union**, and `Kind` decides which sub-object you supply. `dashboard` (opens a dashboard panel) requires `Dashboard`, and `query` (opens an Explore query) requires `Query`. Supplying the other one, or an unknown field, is rejected. - `TimeRange` (`InvestigationTimeRange`: `BeforeSeconds` and `AfterSeconds`) is required on **every** saved entry — both directions are non-negative and at least one is greater than zero. - The `Dashboard` entry (`DashboardInvestigationTarget`) replaces the old `VariableBindings` (keyed by dashboard variable name, with values of `{source: event_label, key: label name}`) with `Variables`: a `map[string]string` keyed by variable name whose values are literal, and may reference event labels through `{{ }}` templates (the old `InvestigationVariableBinding` type is gone). `DashboardID` and `Variables` are required and `TargetID` is optional; `DashboardID` and `TargetID` must both be canonical UUIDv7 values. diff --git a/en/monitors/alert-rules/active-alerts.mdx b/en/monitors/alert-rules/active-alerts.mdx index 24f1d2140..451798f90 100644 --- a/en/monitors/alert-rules/active-alerts.mdx +++ b/en/monitors/alert-rules/active-alerts.mdx @@ -60,6 +60,7 @@ When you add a label-type column, the corresponding label filter automatically a Each row has a **View details** entry, the eye icon at the end of the row. It opens the active alert detail drawer, which has the following sections: - **Alert overview**: current status (active), severity, active duration, and notification count +- **Investigation entries**: the [investigation entries](/en/monitors/alert-rules/investigation-entries) snapshot of the rule that produced this alert, one row each, clickable through to the dashboard or the Query Workbench. This block renders the **snapshot taken when the alert was produced**, not the rule's current configuration: editing the rule afterwards does not change what an already-accepted alert shows, and an alert produced before the configuration took effect shows `This alert has no investigation links. Select an alert generated after the configuration took effect.` Entries whose snapshot failed to render (a variable that failed to render, a query that failed to render and was therefore not run, or a whole event with no snapshot) are still listed, but carry a red `Entry error` label and give no link - **Time information**: first fired, last evaluated, last notified, and last updated - **Rule & source**: alert rule, check mode (Threshold / Data exists / No data), data source name, data source type, instance type, and query Ref - **Current values**: a snapshot of the query result values that triggered the alert diff --git a/en/monitors/alert-rules/investigation-entries.mdx b/en/monitors/alert-rules/investigation-entries.mdx new file mode 100644 index 000000000..bb5176a27 --- /dev/null +++ b/en/monitors/alert-rules/investigation-entries.mdx @@ -0,0 +1,200 @@ +--- +title: "Investigation entries" +description: "Configure investigation entries on a Monitors alert rule: jump from an alert straight to a dashboard or to an initial query in the Query Workbench, including entry fields, template variables, validation limits and snapshot semantics." +keywords: ["investigation entries", "alert rules", "dashboard entry", "query entry", "Go Template", "snapshot"] +--- + +An alert rule can carry a set of **investigation entries**. Each entry is a pre-configured jump target: open a dashboard, or open an initial query — already written, and rendered with the alert's labels — in the Query Workbench. A responder starting from one alert sees the chart or the data they need without writing a query. + +Entries are configured in the rule form's **sixth section, "Investigation entries"** and are saved with the rule. They are rendered into a snapshot **at the moment the alert event is produced** and travel with the event; changing the rule afterwards does not affect alerts already accepted. + + +Saving investigation entries requires monit-edge `v0.75.3` or later. Saving checks **every** active instance in the clusters of the data sources the rule matches: if any instance is older than `v0.75.3`, saving is rejected. See [Edge version requirement at save time](#edge-version-requirement-at-save-time). + + +## How it works + +A rule can hold many investigation entries. Each entry has three parts: the entry type (dashboard or query), the configuration for that type, and a time range relative to the alert event time. + +- **An entry is a weak navigation reference.** Saving the configuration and rendering the snapshot never run a query and never read the dashboard. Entries do not participate in alert evaluation, alert identity, instance identity or lifecycle, and they trigger no automatic investigation task. +- **An entry follows the event's data source.** A rule can match several data sources by type plus name pattern, but each alert event comes from exactly one of them. A query entry runs on the **event's own data source** by default, so the jump lands on the data source that fired the alert rather than on a fixed or default one. You can also name a different data source explicitly (for example to drill into a log data source). +- **Rendering happens when the alert is ingested.** When monit-webapi accepts an event, it renders the entries configured on the rule at that moment — using the final event time, the event's raw data labels and the event data source — into a snapshot (the Investigation Context), which is stored and delivered with the event. The investigation block in the **active alert** detail drawer, the **Investigation** block in an incident's comprehensive info panel (see [Incident details](/en/on-call/incident/search-view-incident#investigation-entries)) and AI SRE all read that same snapshot. +- **The block has a different name on each side**: it is called **Investigation entries** in Monitors and **Investigation** in incident details, but both render the same event snapshot. +- **Order affects display only.** Entries can be dragged into any order, but the first one carries no default, primary or recommended meaning, and the order never reaches alert evaluation or lifecycle. + +## Entry types + +| Entry type | Button | Jumps to | Notes | +|---------|------|--------|------| +| **Dashboard entry** | Add dashboard entry | The dashboard viewer | Can target the whole dashboard, a tab, a section or a panel, and sets the values of that dashboard's template variables | +| **Query entry** | Add query entry | The Query Workbench | Stores one editable initial query (query type + query + query parameters) and optionally the data source it runs on | + +Neither type supports runbooks, tickets or arbitrary URLs. + +## Adding and editing entries + +**Menu path**: the alert rule form → section 6, "Investigation entries". + +1. Click **Add dashboard entry** or **Add query entry** to open the entry dialog. The dialog title distinguishes new from existing entries (Add dashboard link / Edit dashboard link / Add query link / Edit query link). +2. Fill in **Purpose** and **Time range** (shared by both types), then the fields for that type. +3. Click **OK** to add the entry to the form. **OK only adds it to the form; the entry takes effect when you save the rule.** +4. Each row offers three actions: **Preview investigation entry** (eye icon), **Edit** (pencil icon) and **Delete** (trash icon). When you view a saved rule's details, the edit action becomes **Details** and the dialog footer offers only **Close**. + +Added entries are listed with a drag handle on the left for reordering. The row title is the **Purpose**; when no purpose is set, a dashboard entry shows the dashboard title (or the dashboard ID when it cannot be read) and a query entry shows the query. + +The limit is **20 entries**: once you reach 20 the two add buttons become disabled and show `Up to 20 investigation entries` (see [Validation and limits](#validation-and-limits)). + +## Shared fields + +| Field | Required | Notes | +|------|------|------| +| **Purpose** | No | One sentence on what this entry helps confirm. Single-line plain text; line breaks are replaced with spaces. The console caps the input at 200 characters and the backend also enforces **≤512 bytes**. The purpose is **not** rendered as a template and is **not** part of duplicate identity (two entries that differ only in purpose are still duplicates). It is shown to responders and read by AI SRE to judge each entry's intent | +| **Time range** | Yes | "**From** N **min before the alert to** M **min after**". A new entry defaults to 60 minutes before and 0 minutes after. Both directions must be non-negative and at least one must be greater than 0 | + +Time range semantics: + +- The anchor is the **alert event time**: start = event time − before, end = event time + after. +- The window is written into the snapshot exactly as configured, and it never drifts with the current time when you open it later. You can adjust the time range after opening the dashboard or the workbench, but adjustments made in the page are not written back to the rule or to snapshots already produced. +- An end time in the future is allowed (that is what a non-zero "after" produces): the entry is available as soon as the alert fires, without waiting for later data. +- The system does not infer, warn about or validate whether the entry's window covers the alert's evaluation window. + +## Dashboard entry fields + +| Field | Notes | +|------|------| +| **Dashboard** | Search by title or description and pick a dashboard; the folder path of the selection is shown below the picker. **Changing the dashboard clears the target object and the variable values**, because both belong to the previous dashboard | +| **Open at** | `Whole dashboard`, or a tab / section / panel inside the dashboard; each option shows its full breadcrumb path. A whole-dashboard entry opens the dashboard itself | +| **Variable values** | One input per template variable of that dashboard. Leave it empty to use the dashboard's own default | + +**Open at** failure handling: if the target object no longer exists in the dashboard (deleted or renamed), the field shows `Missing object ()` together with the warning `The selected object no longer exists in the dashboard. The dashboard will open on its default tab.` — the jump opens the dashboard's default tab instead of failing. When the dashboard itself cannot be loaded (deleted, or you have no access), the field area shows `Failed to load the dashboard. It may have been deleted or you may not have access.` and **Open at** is not selectable. + +**Variable values** rules: + +- A dashboard with no variables shows `This dashboard has no variables`. +- Variable values are rendered as **Go templates**; see [Template variables](#template-variables). Datasource variables are marked `(datasource)` and their placeholder is `{{ $datasource.id }}`; other variables are prompted with `Leave empty to use the dashboard default, e.g. {{ $labels. }}`. +- Empty means not configured, and the dashboard applies its own rule for the default. Configured but failing to render, or rendering to an empty string, leaves the variable `unresolved` (it does not fall back to the default) and shows an error on the entry. +- A variable that is configured but no longer exists in the dashboard (or was renamed) is still listed and marked `No longer in dashboard`, so you can clean it up — otherwise it would affect the dashboard's variable resolution invisibly. +- Deleting, renaming or changing the type of a variable, or invalidating its candidates, never updates the rule. + +## Query entry fields + +| Field | Notes | +|------|------| +| **Data source** | Defaults to `Alert event datasource` (the query is written against the rule's data source type); you can also pick a specific data source. When the rule's data source type is not queryable in the workbench, the `Alert event datasource` option is disabled and labelled `Alert event datasource (not supported for this rule type)`, so the entry must name a data source explicitly. **Changing the data source resets the query**, because the query language changed | +| **Query type** | Only shown for data sources with more than one query type (Prometheus: Graph only / Raw only; Loki: Range / Instant; VictoriaLogs: Raw logs / Instant stats / Range stats). Prometheus "Graph + Raw" is not offered here because it is two executions and cannot be stored as one query. SQL-type data sources, SLS and Tencent CLS each have a single query mode and therefore no such row | +| **Initial query** | The query editor, with the same syntax and completion as the Query Workbench. The whole expression is rendered as a Go template and inserted **verbatim — no automatic quoting or escaping** | +| **Query parameters** | The data source's named parameters, per data source type (Limit, Direction, Min step (s), the SLS project / logstore, the Tencent CLS region / topic / syntax). Parameter values are **not templated** | + +With the event data source selected, a rule type that the workbench does not support shows `Choose a datasource type under "Datasource and query" first, or pick a datasource for this entry`; an explicitly selected data source that was deleted or that you cannot use shows `The selected datasource is unavailable`. The data source's real type, permissions and provider-specific restrictions are re-checked by the workbench as the current user when the entry is opened or run. + +## Template variables + +The template context for investigation entries has **exactly two variables**: + +| Variable | Type | Notes | +|------|------|------| +| `$labels` | `map[string]string` | The alert event's **raw data labels**. Rule-appended labels are not merged in, labels returned by label enrichment are not merged in, and label names are not filtered | +| `$datasource` | `map[string]string` | The data source the event came from, with fixed keys: `id` (decimal data source ID), `name`, `type`, `address` | + +- Read a simple label directly: `{{ $labels.service }}`. For label names containing dots or other special characters, use `{{ index $labels "service.name" }}`. +- **Accessing a missing label or a key that `$datasource` does not have fails explicitly** (including through `index`) instead of silently producing an empty string, which would turn into an unfiltered query. +- The dot (`.`) only means a local data context such as `range` / `with`; it is not the full alert event. Variables available in the [Description template](/en/monitors/alert-rules/description-template) such as `$values`, `$value`, `$annotations` and `$appendLabels` are **not** available here, and the root object cannot be used to bypass that restriction. +- Conditionals, loops, local variables and built-in functions of Go templates are supported. The template is rendered **once**: a `{{ }}` produced by the rendering is not executed again. + +Dashboard variable examples: + +```gotemplate +{{ $labels.service_name }} +{{ $datasource.id }} +``` + +Query example (VictoriaLogs): + +```text +event_name:="webhook.attempt.completed" +service:="{{ $labels.service_name }}" +outcome:="failure" +``` + +**The query expression owns its quoting and escaping.** A template only produces the value itself: the quotes in `service:="{{ ... }}"` are part of LogsQL syntax and must be written by the expression. When you need escaping, use a function with fixed semantics explicitly — `replace` (literal replacement), `regexQuoteMeta` (regex metacharacters), `urlquery` / `html` / `js` — because the system does not infer escaping from the data source dialect. If rendering fails, or the rendered result does not satisfy the query payload requirements, the entry keeps its initial template and the error, and **no executable query is produced or run**. + +## Previewing an entry + +Click the eye icon on an entry to open the **Preview investigation entry** dialog, which renders that entry from a real event snapshot so you can confirm the jump before relying on it. + +- Prerequisites: the **rule must be saved** (otherwise it says `Save the rule first, then preview once it has an alert.`) and the rule must **currently have an active alert** (otherwise `This rule has no active alerts. Preview will be available once an alert fires.`). The dialog picks a sample from the rule's active alerts, with paging above 20. +- The preview uses the selected alert's **event snapshot** and **does not include unsaved changes in the form**, so save the rule and wait for it to fire before previewing a new configuration. +- Clicking an entry in the dialog opens the target in a new tab. If that alert has no snapshot matching this entry, it says `This alert has no matching snapshot for this entry. Select an alert generated after the configuration took effect.`; if the alert has no snapshot at all, it says `This alert has no investigation links. Select an alert generated after the configuration took effect.` + +## Validation and limits + +| Limit | Value | Notes | +|------|-----|------| +| Number of entries | At most **20** | The console says `At most 20 investigation entries are allowed`; the API error is `investigation_targets must not contain more than 20 items` | +| Total size | At most **32 KiB** | Measured on the serialized entry list. The console says `Investigation entries exceed 32 KiB in total; shorten the queries or variable templates`; the API error is `investigation_targets must not exceed 32768 bytes` | +| Dashboard entry | A dashboard must be selected | `Investigation entry #N has no dashboard selected` | +| Query entry | A query must be filled in | `Investigation entry #N has no query` | +| Query entry | When the rule's type is not queryable in the workbench, a data source must be named | `Investigation entry #N needs a datasource: this rule's datasource type is not supported by the query workbench` | +| Time range | Both directions non-negative, length greater than 0 | `Investigation entry #N needs a time range longer than 0` | +| Purpose | 200 characters in the console input, **≤512 bytes** on the backend | `The purpose of investigation entry #N is too long`. 200 CJK characters can exceed 512 bytes, in which case it is rejected as well | +| Duplicates | Not allowed | `Investigation entry #N duplicates entry #first` | + +Duplicate identity: + +- **Dashboard entries**: the same dashboard plus the same target object is a duplicate, **regardless of variable values and time range**. Duplicates cannot be used to express a variable fallback or multiple instances. +- **Query entries**: de-duplicated by the normalized data source, query (mode, expression, arguments, minimum step) and time range; the event data source (no data source named) counts as its own distinct value. Several **different** queries may be configured on the same data source. + +These checks run in two places: in the entry dialog (only the entry being edited, so it can be fixed item by item) and when the rule is saved (the whole set, with the error shown under the section). The API additionally validates that dashboard IDs and target objects are canonical UUIDv7, that variable names are legal and that templates parse, and it rejects unknown fields. + +## Edge version requirement at save time + +Investigation entries require monit-edge **`v0.75.3` or later**. To drive the upgrade, the version gate is enforced **at save time**; event handling never checks the version: + +- **When it applies**: the saved rule carries non-empty entries and the request either submitted non-empty entries explicitly, or kept existing entries while changing the data source scope (data source type, name patterns or exact bindings). A rule with no entries, an explicit empty array, and requests that only change other fields are not checked. +- **What it checks**: every data source the rule currently matches, and the **active instances** of the Edge clusters those data sources belong to. Data sources without any active instance are skipped; a rule that matches no data source at all is allowed to save. +- **To pass**: every checked instance must be at version `v0.75.3` or later. An unrecognizable version counts as failing. +- **On rejection**: no field is saved, and the request returns an upgrade error listing the minimum version and the failing data sources, Edge clusters, instance IPs and versions (bounded in number). The message looks like: `investigation_targets require monit-edge v0.75.3 or later on every active instance serving the rule's datasources; upgrade cluster "" : (v0.75.2)`. +- The gate covers every write path: create, update, batch field updates that can change entries or the data source scope, and native-bundle and legacy JSON imports. Rules imported from external formats (Prometheus, Nightingale and so on) always have an empty entry list and are unaffected. +- After a successful save, a newly added or downgraded low-version instance does **not** invalidate the saved rule; the check runs again only when you next submit entries or change the data source scope. + +## Snapshot semantics and failures + +**Entries come from the event snapshot, not from the rule's current configuration.** They are rendered once when the alert is accepted, and afterwards: + +- If you change the entries on the rule, alerts **already accepted** (active alert details, the Investigation block on an incident) keep showing the old snapshot; +- Repeat notifications and terminal events reuse the same snapshot, shifting each entry's window by the difference in event time; the rule is not read again; +- Deleting the rule does not remove historical snapshots — the incident side then shows `The alert rule was deleted, so no investigation entries were generated`. + +**Alerts accepted before the configuration took effect have no snapshot.** An alert produced before you saved the entries shows `This alert has no investigation links. Select an alert generated after the configuration took effect.` in its details. Verify with alerts produced after the configuration took effect. + +**When the whole event fails to render, no snapshot is produced** and a bounded error code is delivered instead: + +| Error code | Meaning | Message in the UI | +|--------|------|---------| +| `rule_missing` | The rule no longer exists | The alert rule no longer exists, so no investigation entries were generated | +| `edge_upgrade_required` | The event came from an older protocol that carries no data source ID (Alert Rule Event v1 and earlier) | The Edge that reported this event is too old to generate investigation entries. Please upgrade Edge. | +| `invalid_config` | The configuration is structurally invalid, the event time is invalid, or the window computed from the event time exceeds the representable range | Investigation entries were not generated because the configuration or event time is invalid | +| `payload_limit` | The rendered result exceeds the size limit (the snapshot itself exceeds 64 KiB) | Investigation entries were not generated because the rendered result exceeds the size limit | + +**A single entry failing to render does not drop it.** When a dashboard variable fails to render, that variable stays unresolved and shows `Variable failed to render: `; when a query fails to render, the entry produces no executable query and is not run, and shows `Query failed to render and was not run: `. Such entries are still listed, carry a red `Entry error` label, and give no link. The remaining entries work normally. + +**Permissions are re-checked at the destination.** A snapshot's visibility follows the alert event itself and is not filtered by dashboard folder or data source permissions when it is generated; opening the dashboard or the workbench re-authorizes as the **current user**, and a target that no longer exists or that you cannot access reports the destination's own error rather than falling back to another resource. + +**A snapshot delivered to On-call has a separate 8 KiB limit.** The full snapshot travels with the alert event as the `__alert_rule_investigation_context` label; when the label value exceeds 8 KiB it is degraded as a whole to `payload_limit` (the incident shows a notice, not a truncated snapshot), and the full snapshot remains available in the active alert details in Monitors. + +## Related pages + + + + The investigation block in the active alert detail drawer renders entries from the event snapshot. + + + How the Investigation block renders the snapshot in an incident's comprehensive info panel. + + + Go Template variables for alert descriptions, whose context differs from investigation entries. + + + An overview of the alert rule form's six sections. + + diff --git a/en/monitors/dashboards/dashboards.mdx b/en/monitors/dashboards/dashboards.mdx index 512d64693..099629abb 100644 --- a/en/monitors/dashboards/dashboards.mdx +++ b/en/monitors/dashboards/dashboards.mdx @@ -17,8 +17,8 @@ Whether you can view or edit a dashboard depends on its **folder** — see [Perm The left side is the folder tree shared with alert rules; the right side lists the dashboards in the current folder. Folders are created, renamed, moved and deleted on the tree — see [Folder management](/en/monitors/folders/folders). -- Search covers the **current folder** only. -- The folder, search term and page are kept in the page address, so links can be shared and returning from a dashboard restores the list. +- The box above the folder tree on the left searches the **current folder** only; the search term and page are kept in the page address, so links can be shared and returning from a dashboard restores the list. +- **Global search** at the top right of the page looks across every folder you can read (the backend filters by permission), ignoring the folder you are currently in: it matches a dashboard's **title or description**, with multiple keywords separated by spaces. Each result shows the title, its folder path and the description, and clicking one opens that dashboard; results are paged 20 at a time and there is a **Retry** button if the request fails. This dialog's search state lives only in the dialog — closing it discards the search, and it is never written into the page address. - Each row's **More** menu offers: move to another folder, clone to this folder, clone to another folder. A clone is a new dashboard whose title gets a "copy" suffix and **does not carry version history**; moving or cloning into another folder requires read access to that folder. ## Create and save a dashboard @@ -63,14 +63,14 @@ Bar, gauge and logs chart types will be supported in a later release. **Data source**: Prometheus, MySQL and Loki are supported. Pick a fixed data source or a **data source variable**, so switching the variable switches the whole dashboard. -**Query mode** is chosen automatically from the data source and chart type: tables use instant values, time series and stat use ranges, and MySQL queries a time window. +**Query mode** decides how a query fetches data: **Range** evaluates the query point by point at the step to draw a trend, while **Instant** computes a single value for the whole time range — there `[$__auto]` spans the entire range. In most cases the data source and chart type choose it: tables use instant values, time series and stat use ranges, and MySQL queries a time window. Loki metric panels (stat and table, plus gauge and bar once those chart types are supported) pick it themselves under **Query → Options → Query mode**, defaulting to Range for stat and Instant for table. Loki time series panels stay on Range, and Prometheus and MySQL offer no choice. | Setting | Description | |--------|------| | **Query expression** | Prometheus / Loki panels can reference template variables as `$name` or `${name}` and use [built-in time variables](#built-in-time-variables). MySQL panels do not support variables | | **Multiple queries** | Only time series supports multiple queries (`A`–`Z`). When switching to another chart type you choose which one to keep | | **Series name** | The display name of each series in a time series, for example, `{{instance}}` becomes the `instance` label value; empty shows all labels | -| **Min step** | The lower bound of the step for Prometheus range queries, 15s by default | +| **Min step** | The lower bound of the step for range queries, 15s by default. Offered for Prometheus panels and for Loki metric panels (stat, table, gauge and bar); instant queries do not accept it, and neither do Loki logs panels | | **Value fields** | The fields a stat panel shows; case-sensitive | | **Unit / decimals / thresholds** | Thresholds can be "higher is worse" or "lower is worse", with warning / critical levels coloured as text or background | | **Table columns** | Unit, thresholds and colouring for numeric columns; background colouring can apply to the whole row | @@ -115,6 +115,18 @@ Where they are available: Built-in time variables work only in **panel query expressions** — not in template variable candidate queries — and do not accept format suffixes such as `:raw`. They are not available for MySQL panels. Using them anywhere else prevents the dashboard from being saved. +### Template checks as you type + +While you write a query expression in the panel editor, it is checked for template syntax immediately, and any write the **backend will reject on save** is listed under the input, judged against the current data source and query mode: + +| Message | What it means and what to do | +|------|-----------| +| "Variable instance is multi-select or allows All and expands to a regex; change `=` to `=~` or saving will be rejected" | A multi-select variable, one that allows "All", or one written explicitly as `${name:regex}` is expanded to a regex by the backend, so it cannot go inside an exact matcher. Click **Switch to regex match** to fix every flagged matcher in one pass: `=` → `=~`, `!=` → `!~` (a LogQL line filter is rewritten the same way) | +| "Variable pod is not defined; check the spelling" | The `$xxx` / `${xxx}` in the expression matches no template variable. Fix the spelling, or define it first in **Manage variables** on the variable bar (see [Template variables](#template-variables)); when text follows the variable name you must write `${name}_suffix`, or the whole thing is read as a longer variable name | +| "Built-in variable __rate_interval is not available for this datasource / query mode; saving will be rejected" | You used a `$__` time variable the data source and query mode do not support. Check the availability list under [Built-in time variables](#built-in-time-variables), and switch the variable or the query mode | + +Variables accept a **format suffix**, written `${name:suffix}`. Panel query expressions (Prometheus / Loki) support two suffixes: `:regex` expands the variable as a regex whether or not it is multi-select, and `:raw` inserts it as is and requires the variable to hold a single value. Built-in time variables do not accept a suffix; data links accept the same syntax, see [Click-to-filter and drill-down links](#click-to-filter-and-drill-down-links). + ## Template variables The variable bar sits above the canvas; each variable is a filter. While editing, click **Manage variables** at the end of the bar to add, change or delete variables. diff --git a/en/monitors/explore/explore.mdx b/en/monitors/explore/explore.mdx index 18044ae59..1c63dcfc2 100644 --- a/en/monitors/explore/explore.mdx +++ b/en/monitors/explore/explore.mdx @@ -10,7 +10,7 @@ The Query Workbench (Explore) is an ad-hoc query interface in Flashduty Monitors - **From the data source list**: Go to **Monitors → Data Sources** and click the "Query Workbench" entry on the target data source row. - **Directly**: open the Query Workbench and select a data source on the page. -- **From incident/alert labels**: In the label area of an incident or alert detail, query-type label rows have an "Explore" icon. It opens the workbench with the alert's triggering query and time window pre-filled. +- **From incident/alert details**: From the **Investigation** block on an incident or alert details page, the **Investigate** popover on an associated alert row, or the hover card on a system label, clicking an entry opens the workbench with the alert's triggering query and time window pre-filled. See [Search and view incidents](/en/on-call/incident/search-view-incident#investigation). ## Query types @@ -72,7 +72,7 @@ In addition to the query expression, some data sources support private parameter | Parameter | Data Sources | Description | |-----------|-------------|-------------| | Limit | Loki / VictoriaLogs | Caps the number of returned rows | -| Min step (seconds) | Prometheus | Lower bound for auto step calculation | +| Min step (seconds) | Prometheus / Loki | Lower bound for the auto step of range queries. The workbench shows this input for Prometheus only; on the Loki side the value comes from a dashboard panel — opening a panel's **Open in query workbench** carries that panel's min step over (see [Fullscreen and query details](/en/monitors/dashboards/dashboards#fullscreen-and-query-details)) | | Direction | Loki / VictoriaLogs | Latest-first or earliest-first | | Project / Logstore | SLS | Required; used in the request URL | | Region / Topic / Syntax | Tencent CLS | Required | @@ -82,23 +82,26 @@ In addition to the query expression, some data sources support private parameter ### Built-in time variables -Prometheus and Loki range queries can use built-in time variables so the query follows the time range you select instead of hard-coding it. Write them as `$__interval` or `${__interval}`. +Built-in time variables make a query follow the time range and step you pick instead of hard-coding them; write them as `$__interval` or `${__interval}`. Prometheus and Loki range queries can use them all; Loki instant queries can use two of them. | Variable | Meaning | |----------|----------------| | `$__interval` | The query step, for example, `30s`, never below **Min step** | | `$__rate_interval` | The step plus 15 seconds, at least 60 seconds; ready for `rate()` | | `$__range` | The length of the time window, for example, `3600s` | -| `$__auto` | In Loki range queries, the same as the step | +| `$__auto` | In Loki range queries, the same as the step; in Loki instant queries, the whole time window length, for example, `1h` | + +Where they are available: | Query | Available variables | |-------|----------------------------------| | Prometheus range (**Graph only**) | `$__interval`, `$__rate_interval`, `$__range` | | Loki range | `$__auto`, `$__interval`, `$__range` | -| Prometheus / Loki instant queries | none | +| Loki instant | `$__auto`, `$__range` | +| Prometheus instant (**Raw only**) | none | -- Using these variables in an instant query returns an error. -- Prometheus's default **Graph + Raw** runs a range and an instant query together, so `$__rate_interval` fails in its instant half. Switch to **Graph only** to use it. +- Using one where it is not supported returns an error: Prometheus instant queries support none of them, and Loki instant queries accept only `$__auto` and `$__range` — `$__interval` and `$__rate_interval` still fail there. +- Prometheus's default **Graph + Raw** fires a range request and an instant request together. When the expression contains a built-in time variable (`$__interval`, `${__auto}`, and the like), the workbench runs the range query only and the **Raw** pane no longer issues an instant query, so it shows no samples and stays on "Not run yet"; when the expression has no built-in time variable, both halves are sent as before. Using `$__rate_interval` no longer requires switching to **Graph only**. - These variables mean the same as their namesakes in [dashboards](/en/monitors/dashboards/dashboards#built-in-time-variables). The workbench has no dashboard variables, so any other `$` text is sent to the data source as is. ## AI query assistant diff --git a/en/monitors/quickstart/quickstart.mdx b/en/monitors/quickstart/quickstart.mdx index 9f63a4d75..548d2cebe 100644 --- a/en/monitors/quickstart/quickstart.mdx +++ b/en/monitors/quickstart/quickstart.mdx @@ -66,7 +66,7 @@ For an engine cluster composed of multiple instances, as long as at least one in There may be many alert rules. Monitors provides a tree-structured grouping for categorized management. Each alert rule must belong to a group. You can create groups first, then create alert rules under the groups. -The create / edit alert rule page is one form with five sections, from top to bottom: **Basic Configuration**, **Data Sources and Queries**, **Alert Conditions**, **Detection Frequency & Effective Time**, and **Event Configuration**. +The create / edit alert rule page is one form with six sections, from top to bottom: **Basic Configuration**, **Data Sources and Queries**, **Alert Conditions**, **Detection Frequency & Effective Time**, **Event Configuration**, and **Investigation entries**. ### Basic configuration @@ -203,6 +203,25 @@ Event Configuration covers **Custom Fields & Related Queries** (collapsed by def The maximum notification count does not represent the number of message reminders end users receive. Because alert events generated by Monitors are delivered to On-call, they may be grouped and noise-reduced; the final send count depends on On-call configuration. +### Investigation entries + +Section 6 configures **investigation entries**: it wires each alert straight to a dashboard view or to an initial query that is already written, so a responder can see the chart or query the data in one jump. + +| Config Item | Description | +|--------|------| +| **Add dashboard entry** | Pick a dashboard and target the whole dashboard, a tab, a section or a panel, setting the values of that dashboard's template variables | +| **Add query entry** | Store an initial query (data source + query type + query + query parameters) that runs on the alert event's own data source by default | +| **Purpose** | One sentence on what this entry helps confirm; optional | +| **Time range** | "N min before the alert to M min after", anchored on the alert event time; defaults to 60 minutes before and 0 after | + +You can add up to 20 entries and drag them into any order (order only affects display). The eye icon on an entry opens a **preview** rendered from one of the rule's real alerts. Entries take effect when you save the rule and are rendered into a snapshot delivered with the alert event, so editing the rule does not change alerts already produced. + + +Saving investigation entries requires monit-edge `v0.75.3` or later: saving checks every active instance in the clusters of the data sources the rule matches, and rejects the save if any instance is older. + + +For the field reference, template variables, validation limits and snapshot semantics, see [Investigation entries](/en/monitors/alert-rules/investigation-entries). + ## View results After configuration is complete, if alert conditions trigger, the status before the alert rule will change to `Triggered`. diff --git a/en/on-call/channel/create-edit.mdx b/en/on-call/channel/create-edit.mdx index 9e2c380c5..233236b75 100644 --- a/en/on-call/channel/create-edit.mdx +++ b/en/on-call/channel/create-edit.mdx @@ -33,7 +33,7 @@ Proper planning can significantly improve operational efficiency. ## Creating a channel -Go to **Channels** → **Create Channel**. The wizard has three steps, and **steps 2 and 3 are skippable** — you can fill them in later from the channel details page. +Go to **Channels** → **Create Channel**. The wizard has four steps, and **steps 2 and 3 are skippable** — you can fill them in later from the channel details page. Step 4, **Alert Grouping**, cannot be skipped, but the wizard pre-selects a grouping method based on your subscription, which you can accept as is. ### Step 1: Channel information @@ -82,10 +82,35 @@ If you click **Skip**, you can add it later under **Channel Details → Escalati Select one or more alert integrations (such as Zabbix, Prometheus, Alibaba Cloud Monitor) to attach to the current channel, and the system generates the corresponding Webhook addresses. +- **Selected integrations** appear at the top of the step; before you pick any, the area reads "Selected integrations will appear here" +- **Available integrations** below can be filtered by name with the **Search integrations** box; a filter with no match shows "No matching integrations", and an empty list shows "No integrations available". Integrations whose visibility is **private** never appear in this list + If you click **Skip**, you can add them later under **Channel Details → Configuration → Integrate Data → Dedicated Integrations**. See [Integrate Alerts](/en/on-call/channel/integrate-data) for details. +### Step 4: Alert grouping + +Choose how the new channel merges alerts into incidents, and adjust the defaults. This step has no **Skip** button: saving the channel writes your choice into the new channel. + +| Method | Description | Plan availability | +| :------- | :--------------------- | :--- | +| **Intelligent grouping** | Decided automatically from how similar the titles, descriptions and label content are | Professional plan and above | +| **Rule-based grouping** | Alerts with identical field values enter the same incident — predictable and previewable | Standard plan and above | +| **No grouping** | Every alert creates its own incident and never joins an existing one | Every plan | + +The wizard pre-selects the first method your subscription allows and marks that card with a **Default** badge: free plans get **No grouping**, Standard gets **Rule-based grouping**, and Professional and on-premises deployments get **Intelligent grouping**. Methods outside your subscription are greyed out, with the tooltip "Your current subscription does not support this grouping method". You can keep the pre-selected defaults or adjust them here: + +| Configuration | Description | +| :--- | :--- | +| **Grouping fields** (rule-based grouping only) | `labels.check` by default; you can multi-select `labels.check`, `labels.service`, `labels.resource` and the alert title | +| **Grouping time** | **Until the incident closes** (default) or **Fixed 60 minutes** | +| **Advanced settings → Strict grouping** (rule-based grouping only) | When on, an empty label counts as a distinct value; off by default | +| **Advanced settings → Fields used for the similarity judgement** (intelligent grouping only) | Fields used by the similarity judgement; `title`, `description`, `labels.service`, `labels.resource` by default | +| **Advanced settings → Alert storm warning** | When on, reaching the merged-alert threshold (100 by default) records an alert storm event and notifies you; off by default | + +Click **Save** to create the channel. For the full description of each method and where to change it after creation, see [Configure noise reduction](/en/on-call/channel/noise-reduction#alert-grouping). + - If you skip steps 2 and 3, Flashduty creates only the channel. You can add or adjust escalation rules and integrations at any time from the channel details page. + If you skip steps 2 and 3, Flashduty creates only the channel. You can add or adjust escalation rules and integrations at any time from the channel details page. The alert grouping configuration from step 4 is saved with the channel. ## Channel overview @@ -163,7 +188,7 @@ Configure noise reduction capabilities under **Configuration** → **Noise Reduc | Capability | Navigation Path | Description | | :--- | :--- | :--- | | **Event Aggregation** | Noise Reduction → Event Aggregation | Control whether events with the same `alert_key` merge into the same alert within the aggregation window | -| **Alert Grouping** | Noise Reduction → Alert Grouping | Merge similar alerts from the same host or service into one incident | +| **Alert Grouping** | Noise Reduction → Alert Grouping | Merge similar alerts into one incident, using intelligent grouping, rule-based grouping, or no grouping | | **Flapping Detection** | Noise Reduction → Flapping Detection | Automatically identify and suppress alerts that oscillate repeatedly in a short time | | **Silence Rules** | Noise Reduction → Silence Rules | Temporarily suppress alert notifications under specific conditions during scheduled maintenance windows or specific time periods | | **Inhibit Rules** | Noise Reduction → Inhibit Rules | Reduce redundant notifications using dependencies between alerts | diff --git a/en/on-call/channel/noise-reduction.mdx b/en/on-call/channel/noise-reduction.mdx index 4e684b1fa..913770ee2 100644 --- a/en/on-call/channel/noise-reduction.mdx +++ b/en/on-call/channel/noise-reduction.mdx @@ -3,7 +3,7 @@ title: "Noise reduction" description: "Reduce alert noise through grouping, silencing, inhibition, and other strategies to improve processing efficiency" --- -**Plan requirement**: Alert aggregation, storm warning, and inhibit rules require an On-call Standard or higher subscription. Silence rules are available on all plans. [Learn more](https://flashcat.cloud/flashduty/price/) +**Plan requirement**: which grouping methods you can pick depends on your subscription — **No grouping** is available on every plan, **Rule-based grouping** requires On-call Standard or higher, and **Intelligent grouping** requires On-call Professional (selectable by default on-premises). Alert storm warning and inhibit rules require an On-call Standard or higher subscription. Silence rules are available on all plans. [Learn more](https://flashcat.cloud/flashduty/price/) An alert storm can bring hundreds of similar notifications. Noise reduction groups these alerts into one incident, so you handle it once instead of wading through repeats. @@ -84,6 +84,13 @@ Go to Channel Details → **Noise Reduction** → **Event Aggregation** to confi Event Aggregation controls the "Event → Alert" merge. When the monitoring system keeps pushing events with the same `alert_key`, it decides whether they merge into the existing alert or each create a new one. +An event merges into an existing alert only when all four conditions hold. If any one of them fails, Flashduty creates a new alert: + +- **Same channel**: the event and the target alert belong to the same channel +- **Same `alert_key`**: the event describes the same alert lifecycle +- **Target alert still active**: recovered or ended alerts no longer accept events +- **Still inside the aggregation window**: after the window expires, a matching `alert_key` still creates a new alert + New channels have Event Aggregation enabled by default, with a window of **24 hours** (1440 minutes). @@ -113,17 +120,22 @@ Go to Channel Details → **Noise Reduction** to configure. Alert grouping merges multiple similar alerts into a single incident for unified assignment and notification. When an alert storm hits, you only need to handle one incident instead of hundreds of repeated notifications. - New channels have alert grouping disabled by default. When disabled, each alert creates an independent incident. + A new channel's grouping method is derived from your subscription. The create wizard's **Alert Grouping** step pre-selects it and marks that card with a **Default** badge, and saving the channel writes that configuration: free plans default to **No grouping**, Standard to **Rule-based grouping** (default grouping field `labels.check`), and Professional and on-premises deployments to **Intelligent grouping** (default fields for the similarity judgement: `title`, `description`, `labels.service`, `labels.resource`). With these defaults the aggregation window is **until the incident closes**, alert storm warning is **off**, and strict grouping is **off**. You can pick another available method in the wizard, or change it later under **Noise Reduction → Alert Grouping**. For the wizard step, see [Create a channel](/en/on-call/channel/create-edit#step-4-alert-grouping). ### Grouping modes -Flashduty On-call provides two grouping modes: +The Alert Grouping page offers three mutually exclusive methods. A choice takes effect only after you save it: + +| Method | Description | Plan availability | +| :------- | :--------------------- | :--- | +| **Intelligent grouping** | Decided automatically from how similar the titles, descriptions and label content are; no manual rules | Professional or higher (selectable by default on-premises) | +| **Rule-based grouping** | Alerts with identical field values enter the same incident — predictable and previewable | Standard or higher | +| **No grouping** | Every alert creates its own incident and never joins an existing one | Every plan | + +In the create wizard, methods your subscription doesn't include are greyed out, with the tooltip "Your current subscription does not support this grouping method". The API field `group_method` carries the same choice: `i` (intelligent grouping), `p` (rule-based grouping), `n` (no grouping); see [Incident webhook](/en/on-call/integration/webhooks/incident-webhook). -| Mode | Use Case | Characteristics | -| :------- | :------------- | :--------------------- | -| **Intelligent Grouping** | Quick start, lower precision requirements | Based on machine learning semantic similarity analysis, no manual rule configuration needed | -| **Rule-based Grouping** | Need precise control over grouping logic | Exact matching by specified dimensions (attributes, labels) | +The **Current effect** card at the top of the page summarizes the active method in one line: with no grouping it reads "No grouping · every alert creates its own incident"; with intelligent grouping it lists the fields used for the similarity judgement; with rule-based grouping it lists the grouping fields (and reports per-alert rules when you use them), alongside the aggregation window, the empty-value rule and the storm-warning state. Switching methods opens a confirmation dialog first: the page then swaps in the new method's settings, and nothing takes effect until you click **Save**. ### Common configuration @@ -141,7 +153,7 @@ Flashduty On-call provides two grouping modes: - Select **Intelligent Grouping** mode + Pick the **Intelligent grouping** card under **Grouping method** at the top of the page (greyed out on Standard, which needs Professional or higher) Select the fields used for similarity calculation. Default fields include: title, description, labels.service, labels.resource. You can add or remove fields based on your needs, up to a maximum of **10** fields. Click **Reset** to restore default settings. @@ -155,23 +167,28 @@ Flashduty On-call provides two grouping modes: - Exact matching by specified dimensions, only groups when all dimension values are identical. + Exact matching by specified dimensions, only groups when all dimension values are identical. The **Grouping rules** section offers two mutually exclusive radio cards: one shared rule for every alert, or different rules for different alerts. - **Unified Control**: All alerts in the channel use the same dimensions for grouping. + **All alerts use the same rule**: every alert in the channel uses one set of **grouping dimensions** (subtitled "what has to match to enter the same incident"). Alerts enter the same incident only when all selected fields have identical values. - - ![Unified Control Configuration](https://download.flashcat.cloud/flashduty/doc/en/fd/noise-3.png) + + ![All Alerts Use the Same Rule Configuration](https://download.flashcat.cloud/flashduty/doc/en/fd/noise-3.png) - **Fine-grained Control**: Match different grouping dimensions by conditions, applying different grouping strategies for different types of alerts. You can add multiple condition branches, each containing match conditions and corresponding grouping dimensions: + **Different alerts use different rules**: match rules per alert by attribute or label. You can add multiple condition branches, each containing match conditions and corresponding grouping dimensions: - The system matches conditions from top to bottom, using the grouping dimensions of the first matched branch - Supports reordering condition branch priority by moving them up or down - - Set **Default Dimensions** at the bottom as a fallback; Flashduty groups alerts that match no condition by these dimensions + - **When no rule matches** sets default fields as a fallback — "alerts are grouped by the default fields below; leave it empty and nothing is grouped". **Left empty, these alerts are not grouped** and each creates its own incident - - ![Fine-grained Control Configuration](https://download.flashcat.cloud/flashduty/doc/en/fd/noise-1.png) + + ![Different Alerts Use Different Rules Configuration](https://download.flashcat.cloud/flashduty/doc/en/fd/noise-1.png) + + After you pick **No grouping** under **Grouping method**, the page shows only a **Turn off alert grouping** card: once saved, every new alert creates its own incident, and existing incidents and alerts are left untouched. The aggregation window, alert storm warning and strict grouping settings are hidden in this mode. + + **No grouping** is available on every plan, and it is the only method a free plan can use. + ### Configuration limits @@ -180,8 +197,8 @@ To protect grouping performance and stability, the following fields have hard sy | Grouping mode | Limit | Cap | Description | | :--- | :--- | :--- | :--- | -| **Rule-based grouping** | Grouping dimensions (equals) | ≤ 5 per group | Number of dimensions per rule in both unified control and fine-grained control | -| **Rule-based grouping** | Fine-grained branches (cases) | ≤ 100 | Total condition branches you can configure under fine-grained control | +| **Rule-based grouping** | Grouping dimensions (equals) | ≤ 5 per group | Number of dimensions per rule under "all alerts use the same rule" and "different alerts use different rules" | +| **Rule-based grouping** | Condition branches (cases) | ≤ 100 | Total condition branches you can configure under "different alerts use different rules" | | **Intelligent grouping** | Fields used for similarity calculation (i_keys) | ≤ 10 | Default 4: `title`, `description`, `labels.service`, `labels.resource` | ### Grouping effect @@ -225,7 +242,7 @@ Go to Channel Details → Noise Reduction → **Flapping Detection**: | **Alert Then Silence** | Mark flapping status, no more notifications after first alert | - New channels enable flapping detection in **Alert Then Silence** mode, with these defaults: 60-minute observation window, 4 state changes, and a 120-minute mute duration. + New channels enable flapping detection in **Alert Only** mode (`mute_mins` is 0): Flashduty alerts once when it detects flapping, and later incidents still notify per their policy. The defaults are a 60-minute observation window and 4 state changes. **Mute duration** applies only in **Alert Then Silence** mode and defaults to 120 minutes; when you switch the mode to **Alert Then Silence**, Flashduty pre-fills the mute duration with 120 minutes. ### Configurable parameters @@ -234,10 +251,12 @@ Go to Channel Details → Noise Reduction → **Flapping Detection**: | :--- | :--- | :--- | :--- | | **State changes** (max_changes) | Number of alert state changes within the observation window to trigger flapping detection | 4 | 2–100 | | **Observation window** (in_mins) | Time window for counting state changes | 60 minutes | 1–1440 minutes | -| **Mute duration** (mute_mins) | Duration to mute notifications after flapping is detected (only applies in "Alert Then Silence" mode) | 120 minutes | 30–1440 minutes | +| **Mute duration** (mute_mins) | Duration to mute notifications after flapping is detected. Applies only in "Alert Then Silence" mode; in "Alert Only" mode the value is 0 and nothing is muted | 120 minutes | 30–1440 minutes | - "Same incident" refers to incidents with the same Alert Key, typically using the alert ID pushed from the upstream system as a unique identifier. + **What counts as the same incident**: Flashduty uses the `alert_key` of the **first alert** associated with each incident as the flapping identity. Two incidents are counted as the same problem inside the observation window only when that identity matches. This judgement does **not** use the grouping dimensions configured on the Alert Grouping page. The `alert_key` is reported by the alert integration or generated by that integration's rules — integrations differ, and you cannot change it on this page. + + The **Current effect** card at the top of the page states the active mode in one line (for example, "Alert only · alerts once when flapping is detected"). ## Silence rules diff --git a/en/on-call/configuration/filter-conditions.mdx b/en/on-call/configuration/filter-conditions.mdx index 08340ce53..fed818d71 100644 --- a/en/on-call/configuration/filter-conditions.mdx +++ b/en/on-call/configuration/filter-conditions.mdx @@ -71,7 +71,7 @@ or ### Matching methods -Target values are always strings; the format decides the matching method: **regex**, **wildcard**, **IP range**, or **numeric comparison**, and anything else is an **exact** match. +Target values are always strings; the format decides the matching method: **regex**, **wildcard**, **CIDR (IP range)**, or **numeric comparison**, and anything else is an **exact** match. The condition editor lists the available methods directly under the input; the fourth one is labelled **CIDR Matching** in the UI. @@ -101,8 +101,8 @@ Target values are always strings; the format decides the matching method: **rege - - When a value has `cidr` as prefix, Flashduty treats the entire value as **IP range**. + + When a value has `cidr` as prefix, Flashduty treats the entire value as **CIDR (IP range)**. **Example**: - `labels.host`: `cidr:10.0.0.206/24` — matches when the host label is within "10.0.0.206/24" range diff --git a/en/on-call/configuration/schedule.mdx b/en/on-call/configuration/schedule.mdx index 8c0b05cc5..470d2dc2c 100644 --- a/en/on-call/configuration/schedule.mdx +++ b/en/on-call/configuration/schedule.mdx @@ -50,7 +50,11 @@ Understanding these concepts before configuration will help you better plan your To prevent forgetting shifts or handoffs, the system provides two notification triggers: - **Advance Notification**: Notifies both outgoing and incoming personnel N minutes before handoff (in 5-minute increments) - - **Scheduled Notification**: Sends a daily notification at a fixed time (for example, 8:00 AM) reminding who is currently on-call. Flashduty reads the fixed time in the schedule's time zone, like rotations and shifts. If your time zone differs, a badge next to the time input shows the schedule's time zone + - **Scheduled Notification**: Sends a notification at a fixed time while the rotation is on duty, reminding who is currently on-call. Pick a cycle of **Daily** / **Weekly** / **Every month**: + - **Daily**: fires every day at the chosen time, 08:00 by default + - **Weekly**: multi-select the weekdays to fire on at the chosen time + - **Every month**: multi-select the days of the month (1-31) to fire on at the chosen time. In a month that has no such day (30 February, say), no notification is sent that month, and the hint next to the selector says so + - Flashduty reads the fixed time as wall-clock time in the **schedule's time zone**, like rotations and shifts. If your time zone differs, a badge next to the time input shows the schedule's time zone After enabling either notification trigger, you need to configure notification channels: diff --git a/en/on-call/incident/alert-management.mdx b/en/on-call/incident/alert-management.mdx index ba1435606..bfb5f92ad 100644 --- a/en/on-call/incident/alert-management.mdx +++ b/en/on-call/incident/alert-management.mdx @@ -97,7 +97,7 @@ The details page body is split into two tabs: | Tab | Description | | :--- | :--- | -| **Alert Overview** | The left side shows the alert description, labels, and **related events preview** (up to 5 entries, with a link to the *Associated Events* tab for the full list); the right side shows attributes (channel, trigger time), images, alert source, associated incident, and Links | +| **Alert Overview** | The left side shows the alert description, labels, and **related events preview** (up to 5 entries, with a link to the *Associated Events* tab for the full list); the right side shows attributes (channel, trigger time), images, alert source, associated incident, and Links. Monit alerts additionally show an **Investigation** block after **Attributes** (see **Investigation** below) | | **Associated Events** | Shows the list of all raw events associated with this alert | Append `?tab=events` to the alert details URL (for example, `/alert/detail/{id}?tab=events`) to open the **Associated Events** tab directly; switching tabs updates the address bar. The **View full event history** link on the incident details page opens alerts this way. @@ -107,6 +107,14 @@ The **Alert Source** is clickable so you can quickly trace where an alert came f - **Alerts from the Monit integration**: Display the name of the rule that produced the alert. Click to jump to that alert rule — Entity Tree rules open the rule editing view directly in Entity Tree, while standalone rules open the rule details page. When older data lacks rule labels, it falls back to showing the integration name and links to the integration details - **Alerts from other integrations**: Display the integration name and type tag (shared or dedicated); click to jump to the corresponding integration details page +### Investigation + +The right column of a Monit alert's details page shows an **Investigation** block after **Attributes**. It is the same panel the incident details page uses: it lists the investigation-entry snapshot (query entries and dashboard entries) that the alert rule produced **at the moment the alert fired**, showing the first **3** entries by default with the rest behind **N more**; below the entries are the **Related Alert Rule** and the rule's **Queries** (main-query values and related-query results at trigger time). + +Alerts from other integrations (Zabbix, RUM, and so on) never show this block; when the rule has no investigation entries, the rule has been deleted, the alert came from an older Edge, or the snapshot exceeds 8KB, the block shows the corresponding message instead. + +For the entry fields, the issue badge, and the full list of failure messages, see [Search and view incidents · Investigation](/en/on-call/incident/search-view-incident#investigation). + ### Alert lifecycle records The system records the entire process from trigger to close. Common record types include: diff --git a/en/on-call/incident/search-view-incident.mdx b/en/on-call/incident/search-view-incident.mdx index ae81fbb15..2c8c6a93b 100644 --- a/en/on-call/incident/search-view-incident.mdx +++ b/en/on-call/incident/search-view-incident.mdx @@ -136,7 +136,7 @@ Incident details is the main entry point for investigating an incident and shows | 2 | Action Area | Various high-frequency action buttons; more actions include custom actions and low-frequency buttons; War Room creation requires enabling [War Room](/en/on-call/advanced/war-room) in IM integration. The snooze button supports customizable duration presets — you can access settings from the snooze dropdown to configure 3 preset durations (in hours or minutes), defaulting to 2 hours, 4 hours, and 12 hours | | 3 | Details | Incident description, label info, and AI Summary (see below for details); labels support drag-to-sort and JSON view display | | 4 | Tab Area | Use the tabs at the top to view richer content; see the **Detail Tabs** section below | -| 5 | Comprehensive Info | Centralizes supporting information such as incident attributes, key timestamps, responders, related links, images, custom fields, and external tickets (see the **Comprehensive Info Panel** section below) | +| 5 | Comprehensive Info | Centralizes supporting information such as incident attributes, key timestamps, responders, related links, images, custom fields, and external tickets; incidents aggregated from Monitors alerts also gain an **Investigation** block (see the **Comprehensive Info Panel** section below) | ### Label deep links @@ -150,7 +150,13 @@ Incident labels appear in the **Details** area of the details page. For incident If a label value is invalid or the needed context is missing, Flashduty shows it as plain text. Labels on the alert details page support the same links. -If a label carries the query from when the alert fired (such as PromQL or a log expression), an **Explore** icon appears on the right of the label. Clicking it opens the Query Workbench in a new tab with that query and a time window around the alert's start time; with several queries, pick one from the list. +Link labels no longer stay in the label list: they are lifted into a **Links** button bar above the list, and label values are recognized by format and rendered as image thumbnails, ARNs, times, or query code blocks. See [What is an incident · Incident labels](/en/on-call/incident/what-is-incident#related-links-and-label-value-rendering) for the recognition rules, button-name mapping, and rendering behaviour. + +The query from when the alert fired is no longer attached to the label row. To get back to the query as it was at trigger time, open the Query Workbench from any of these places: + +- **The hover card on a system label**: hover over query-type system labels such as `__alert_rule_queries`, `__alert_rule_values`, and `__alert_rule_relate_queries` to see the query and the values at trigger time +- **The comprehensive info panel's investigation entries**: the **Investigation** block in the right-side panel lists the rule's queries per entry type (see **Investigation** below) +- **The "Investigate" popover in the Associated Alerts tab**: every alert row builds its entries from that alert's own labels ### AI summary @@ -176,14 +182,41 @@ The comprehensive info panel on the right side of the incident details page cons | Section | Description | | :--- | :--- | +| **Responders** | Lists all responders (individuals or on-call personnel) assigned to the incident along with their acknowledgment status | | **Attributes** | Basic attributes such as channel, incident trigger time, and alert count | +| **Investigation** | Appears only for incidents aggregated from Monitors alerts. Lists the investigation entries snapshot configured on the alert rule, showing 3 entries by default; below it you also get the alert rule that produced the incident with its main and related queries. See **Investigation** below | | **Images** | Displayed when alerts associated with the incident include image information reported by API. Click a thumbnail to preview, and hover to view the Alt description and source link | | **Key Timestamps** | A timeline view of key timestamps in the incident lifecycle, including **trigger time**, **first acknowledgment time**, **close time**, and reopen events, so you can quickly grasp incident progress | -| **Responders** | Lists all responders (individuals or on-call personnel) assigned to the incident along with their acknowledgment status | | **Related Links** | Shortcut links preconfigured in the owning channel (such as dashboards, runbooks, knowledge bases). Parameters are dynamically rendered from the current incident's labels or fields, enabling one-click navigation to related systems. Link templates are maintained in channel settings | | **Custom Fields** | Displays and allows editing of the incident's custom field values; unset fields are shown as `-` | | **External Tickets** | If you have configured ticket integrations such as Jira, ServiceNow, or ServiceDesk Plus, external tickets created from this incident appear here and can be clicked to open in the external system | +### Investigation + +For incidents aggregated from Monitors alerts, the comprehensive info panel gains an **Investigation** block between **Attributes** and **Images**. It does not show live query results: it renders the investigation-entry snapshot that the alert rule produced **at the moment the alert fired**. The panel only renders that snapshot and never recomputes the queries. + +Each entry is one row showing the entry-type icon (query or dashboard), the **purpose** configured on the rule, and the data source (name plus type icon). When the rule has no purpose, a query entry shows its query expression instead, and a dashboard entry shows the dashboard title and its location path (the whole dashboard, or `Tab › Panel`). Entries that render with a problem carry an orange dot on the type icon. + +- Hovering an entry opens a detail card with the full query expression (copyable), the named **variables** (filled in from the alert's labels; unresolved ones are highlighted in red), and the **time range** — the relative window on one line (for example "60 min before → 10 min after the alert") and the absolute start and end on the next. An **Open** button at the bottom opens the corresponding view in the Query Workbench or dashboard in a new tab +- The number next to the heading is how many entries the snapshot holds; the **N with issues** badge counts the entries that render with a problem (query failed to render, dashboard variable unresolved, data source or dashboard deleted or unauthorized) +- Only the first **3** entries show by default; the rest sit behind **N more**, which expands and collapses +- Below the entries are the **Related alert rule** card (rule name plus data source, clickable through to the rule) and the rule's **Queries**: main queries are listed by `A` / `B` with the **value at trigger time**, hover for the full expression with a copy button, and a no-data alert is marked **No data** on the matching main query; related queries show the **result table at trigger time** + +When the rule has no investigation entries configured, the block says "No investigation entries configured on the rule" and offers a **Configure** link. In the following cases it shows a single failure message instead: + +| Situation | Message and action | +| :--- | :--- | +| The rule's investigation entries are misconfigured | "The rule's investigation entries are misconfigured and were not generated", with **Edit rule** | +| The alert rule has been deleted | "The alert rule was deleted, so no investigation entries were generated" | +| The alert came from an older Edge | "This alert came from an older Edge. Upgrade to v0.75.3 or later and new alerts will include investigation entries" | +| The snapshot exceeds 8KB | "Investigation entries exceed 8 KB and could not be attached; view them in the monitoring alert details" | + +Incidents aggregated from non-Monit integrations (Zabbix, RUM, and so on) never show this block; older Monit alerts that carry no investigation-entry snapshot show only the **Related Alert Rule** and **Queries** below it. + +In the **Associated Alerts** tab, each alert row also has a magnifier **Investigate** icon. It opens an "investigation entries for this alert" popover: in a multi-alert incident each alert has different labels, and the popover builds entries from **that alert's own labels**, so its entries can differ from the right-side panel. + +The right column of the alert details page embeds the same panel; see [Alert management · Alert details](/en/on-call/incident/alert-management#investigation). + ### Detail tabs The incident details page contains 7 tabs; some appear only under certain conditions: diff --git a/en/on-call/incident/what-is-incident.mdx b/en/on-call/incident/what-is-incident.mdx index bcdc07e28..588de5f7f 100644 --- a/en/on-call/incident/what-is-incident.mdx +++ b/en/on-call/incident/what-is-incident.mdx @@ -63,17 +63,55 @@ Flashduty extracts alert labels from the event messages that the monitoring syst Flashduty On-call provides label enhancement for automatic label generation. Go to [Configure Label Enhancement](/en/on-call/integration/alert-integration/label-enhancement) to learn more. -### Hide meta labels +### System labels -The label panel on the incident/alert details page has a **Hide Meta Label** / **Show Meta Label** toggle. It filters out internal labels whose names start and end with `__`, such as the Prometheus-style `__instance__` or `__name__`. +The label panel on the incident/alert details page collects platform-internal labels into a separate **System labels** section, with a **Hide system labels** / **Show system labels** toggle (with an eye icon) next to the heading. Which labels count as system labels depends on the alert source: -- The button only appears when the current incident or alert actually contains meta labels +| Alert source | Labels treated as system labels | +| :--- | :--- | +| Monit alerts (`monit.alert`) | Names starting with `__alert_rule_` or `__entity_alert_`, such as `__alert_rule_id` or `__entity_alert_promql`. Internal labels that are not Monit's own — `__name__`, for instance — stay in the regular label list | +| Other sources | Names starting with `__alert_rule_` / `__entity_alert_` / `__flashduty_`, or names that both start and end with `__`, such as `__instance__` or `__name__` | + +- The toggle appears only when the labels actually contain system labels. Its tooltip states the rule used for the current alert source: Monit alerts show "Monit system labels start with `__alert_rule_` or `__entity_alert_`", other sources show "System labels are platform labels starting with `__`, such as `__alert_rule_id` and `__name__`" +- System labels are **collapsed by default**. While collapsed, the bottom of the list holds a dashed button reading "N system labels collapsed (first few keys…)"; clicking it expands a separate **System labels** section with a divider, and the toggle next to the heading collapses it again - Flashduty saves the toggle as a **per-user preference** that persists across sessions and devices; the mobile app and the web console share the same preference -- When meta labels are hidden, the JSON view, formatted view, copy action, and drag-to-reorder all operate on the filtered label set +- The count badge next to the heading is the total number of labels (system labels and related links included), not the number of rows currently visible +- While system labels are collapsed, the **JSON view** and the JSON you copy exclude them too; drag-to-reorder applies to regular labels only, and system labels are never reordered +- System labels written by Monit come with a hover card that translates the machine-readable label into a plain-language alias and offers a jump: `__alert_rule_id` → the alert rule, `__alert_rule_folder_*` → the rule's folder, `__alert_rule_data_source_*` → the data source, `__alert_rule_event_kind` → firing / repeating / resolved, `__alert_rule_values` and `__alert_rule_queries` → each main query's value and expression at trigger time, `__alert_rule_relate_*` → related queries and their result at trigger time, `__alert_rule_investigation_context*` → investigation entries - - For Prometheus, Nightingale, and other sources with many internal labels, hide meta labels by default to keep the panel on business dimensions. - +### Related links and label value rendering + +The label panel shows a **Links** button bar above the list and renders some label values specially. + +**Related links**: labels whose value is an `http(s)://` link and that are not images stop acting as regular, sortable labels — they are lifted above the list, one button per link. The button name comes from the label key: + +| Label key | Button name | +| :--- | :--- | +| `generatorURL`, `generator_url`, `detail_url`, `link`, `web_url`, `client_url`, `insight_url` | **View source**; shown as **View in {source}** when the alert's integration has a name | +| `runbook_url` | **Runbook** | +| `silenceURL` | **Silence** | +| `dashboardURL`, `dashboard_url` | **Open dashboard** | +| `panelURL` | **Open panel** | +| `query_url` | **View query** | +| `log_url` | **View logs** | +| `alert_url` | **View alert** | +| `ruleURL`, `rule_url`, `alert_rule_url` | **View rules** | +| `alert_history_url` | **Alert history** | +| Any other key | `key · host` | + +Buttons follow the order of the table above; keys not listed come after them in alphabetical order. Hovering a button shows the full key and URL. Image links (a key containing `image`, or a link ending in an image extension) are not related links and stay in the label list. This extraction applies to regular labels only — link labels already in the **System labels** section stay where they are. + +**Special label value rendering**: label values are recognized by format and rendered as follows. Recognition looks only at the key name and the value's format; it does not depend on per-integration metadata. + +| Form | Recognition | Rendering | +| :--- | :--- | :--- | +| Image thumbnail | The value is an `http(s)` link and the key contains `image` (Grafana's `imageURL`, for example), or the link ends in `.png` / `.jpg` / `.jpeg` / `.gif` / `.webp` / `.svg` | A 160 x 90 thumbnail; clicking opens the original image in a new tab. The request carries no referrer and the image loads lazily as it scrolls into view | +| ARN | The value looks like `arn:partition:service:region:account:resource` | The resource segment on the main line, followed by small **Service** / **Region** chips | +| Time | The key ends in `_time` / `_at` / `timestamp` and the value is a 10-digit (seconds) or 13-digit (milliseconds) timestamp falling between 2000 and 2100; or the value is an ISO 8601 time with a time zone | Formatted as `YYYY-MM-DD HH:mm:ss` in the account's time zone with a relative "x ago"; hover shows the original value | +| Time (no time zone) | The value is a wall-clock string such as `YYYY-MM-DD HH:mm` with no time zone | Shown as-is, with no time-zone conversion | +| Query expression | The key ends in `ql` / `promql` / `logql` / `query` / `expression` / `sql` (preceded by a separator or the start of the string, so `mysql` and `graphql` are not misread) | A monospace code block with a copy button for the whole expression | + +Forms that already have a fixed display size — images and query expressions — are not truncated to two lines; other values longer than two lines are collapsed behind a **View all** / **Collapse** toggle. ## Incident lifecycle diff --git a/en/on-call/integration/alert-integration/routing-rules.mdx b/en/on-call/integration/alert-integration/routing-rules.mdx index f8528dfc4..da6097470 100644 --- a/en/on-call/integration/alert-integration/routing-rules.mdx +++ b/en/on-call/integration/alert-integration/routing-rules.mdx @@ -22,11 +22,25 @@ Go to Integration Center → Alert Events → Integration Details → **Routing* | Config Item | Description | | :--- | :--- | -| **Match Condition** | Filter alerts by labels, attributes, and so on; supports exact, wildcard, regex matching | +| **Match Condition** | Filter alerts by labels, attributes, and so on; supports five matching methods: exact, wildcard, regex, CIDR (IP range), and numeric | | **Routing Mode** | See detailed description below | | **Flow Control** | **Continue Matching** (default): Continue matching subsequent rules after hit; **Stop Matching**: Don't match further after hit | | **Default Route** | Fallback rule that takes effect when no rule actually delivers the alert to any channel | +### Matching methods + +**Match Condition** values are always strings, and the format decides the matching method. The condition editor lists the five supported forms directly under the input: + +| Method | Example | Recognition rule | +| :------- | :----------------------- | :-------------------------------- | +| **Exact** | `cpu.idle<10%` | When nothing else matches, values must be identical | +| **Wildcard** | `host * down` | A value containing `*` or `?` and no `/` prefix/suffix is treated as a wildcard | +| **Regex** | `/api-server-\d+/` | A value wrapped in `/` is treated as an RE2 regex | +| **CIDR** | `cidr:192.168.1.0/24` | A value prefixed with `cidr:` matches by IP range | +| **Numeric** | `num:gt:0.95` | A value prefixed with `num:` plus a comparison operator (`gt`/`ge`/`lt`/`le`) is compared numerically | + +For the complete syntax and examples, see [Configure filter conditions](/en/on-call/configuration/filter-conditions#matching-methods). + ### Routing modes | Mode | Description | Use Case | diff --git a/en/platform/team-members.mdx b/en/platform/team-members.mdx index 9af281b3d..241bece03 100644 --- a/en/platform/team-members.mdx +++ b/en/platform/team-members.mdx @@ -123,10 +123,10 @@ Licenses determine whether a member can view and handle incidents. In the member You can perform the following actions in the License column of the member list: - **Grant Fixed License**: Assign a fixed license to a member, provided there are available license slots -- **Revoke License**: Release the member's license; the member will no longer be able to view or handle incidents +- **Revoke License**: Release the member's license; the member will no longer be able to view or handle incidents. Releases are subject to the [limit on the number of License releases in each billing period](/en/platform/pricing): once the current period's quota is used up, **Revoke License** is greyed out on the rows of members holding a fixed or temporary license (hover to see when the quota resets), and the **None** option in the member editor can no longer be selected until the next billing period begins -The total number of licenses depends on your subscription plan. When all licenses are allocated, you need to release another member's license or upgrade your subscription to assign one to a new member. +The total number of licenses depends on your subscription plan. When all licenses are allocated, you need to release another member's license or upgrade your subscription to assign one to a new member. If this billing period's release quota is used up, upgrading your subscription is for now the only way to add a license, and releases resume in the next billing period. Removing a member is not subject to the release quota and releases that member's license. ### Member detail page diff --git a/en/rum/quickstart/app-management.mdx b/en/rum/quickstart/app-management.mdx index 74146994a..561d631b0 100644 --- a/en/rum/quickstart/app-management.mdx +++ b/en/rum/quickstart/app-management.mdx @@ -353,7 +353,7 @@ The repository names shown in the list link to the corresponding repository on G The **Remote Configuration** tab lets you adjust collection and privacy parameters online, without code changes or a new release. When enabled, the configuration on this page overrides SDK initialization settings. When disabled, clients fall back to their SDK initialization settings and data collection continues uninterrupted. -- Remote Configuration is currently available for **Browser**, **iOS**, **Android**, **Flutter** and **WeChat Mini Program** applications. Other platform types will be enabled as their SDKs ship support. +- Remote Configuration is currently available for **Browser**, **iOS**, **Android**, **HarmonyOS**, **Flutter** and **WeChat Mini Program** applications. Other platform types will be enabled as their SDKs ship support. - The **Remote Configuration** tab is open to every account, on SaaS and private deployments alike — there is nothing for support to enable. Whether the tab appears depends only on whether the application type is one of the supported platforms listed above. @@ -363,18 +363,19 @@ The **Remote Configuration** tab lets you adjust collection and privacy paramete |------|------|------| | **Session sample rate** | Integer 0–100 (%) | Percentage of sessions collected. Leave it empty to skip delivering this field; clients keep the value set at SDK initialization | | **Session replay sample rate** | Integer 0–100 (%) | Percentage of sessions recorded by Session Replay. If empty, the SDK setting applies | -| **On-error session capture** (`sessionOnError`) | On / Off / Use SDK setting | For sessions missed by session sampling, uploads up to the last minute of events on error and continues collection; requires Web SDK 0.3.0 or later | +| **On-error session capture** (`sessionOnError`) | On / Off / Use SDK setting | For sessions missed by session sampling, uploads up to the last minute of events on error and continues collection; Web applications require Web SDK 0.3.0 or later, HarmonyOS applications require a HarmonyOS SDK that supports the option | | **On-error replay capture** (`sessionReplayOnError`) | On / Off / Use SDK setting | For collected sessions missed by replay sampling, uploads buffered replay on error and continues recording; requires Web SDK 0.3.0 or later | | **Trace sample rate** | Integer 0–100 (%) | A second session-level sampling pass within already-collected sessions, deciding which sessions inject trace headers into eligible requests; the outcome is consistent within one session. Overall trace coverage is roughly *session sample rate × trace sample rate*. If empty, the SDK setting applies | | **Replay privacy level** | `mask` / `mask-user-input` / `allow` | Default masking of page content in Session Replay: `mask` obscures text and hides input values; `mask-user-input` keeps page text and hides only what users typed; `allow` records the page as it is. Loosening the level starts collecting content that was not collected before, and replays already uploaded cannot be retroactively masked. The console asks you to confirm again before publishing | | **Custom configuration keys** | Key–value pairs typed as string / number / boolean / JSON | Delivered to clients together with the remote configuration and read by your application code; the platform does not interpret them. Up to 5 keys; each key name is at most 64 bytes (counted in UTF-8, not characters), each value at most 4 KB and nesting at most 3 levels (objects and arrays each count one level), and all custom entries together at most 16 KB | -The two on-error options are independent: **On** delivers `true`, **Off** delivers `false`, and **Use SDK setting** omits the field so the corresponding `init()` option applies (off if unset). Browser applications require Web SDK 0.3.0 or later with `remoteConfigurationEnabled: true` at initialization. Turning off on-error capture does not affect sessions selected by ordinary sampling. See [Web SDK on-error session capture](/en/rum/sdk/web/advanced-config#on-error-session-capture) for scope, billing, and limitations. +The two on-error options are independent: **On** delivers `true`, **Off** delivers `false`, and **Use SDK setting** omits the field so the corresponding `init()` option applies (off if unset). Browser applications require Web SDK 0.3.0 or later with `remoteConfigurationEnabled: true` at initialization; HarmonyOS applications use the same `sessionOnError` option (with `.setRemoteConfigurationEnabled(true)` at initialization) and have no on-error replay option. Turning off on-error capture does not affect sessions selected by ordinary sampling. See [Web SDK on-error session capture](/en/rum/sdk/web/advanced-config#on-error-session-capture) for scope, billing, and limitations. -iOS, Android, Flutter, and WeChat Mini Program applications also show the **Remote Configuration** tab. Their SDKs read only the **session sample rate** and **custom configuration keys**. None of them has Session Replay, and the other values have no effect. Every SDK has to opt in with `remoteConfigurationEnabled: true` at initialization (off by default; an application that has not opted in never requests the configuration). Minimum versions: +iOS, Android, Flutter, and WeChat Mini Program applications also show the **Remote Configuration** tab, but their SDKs read only the **session sample rate** and **custom configuration keys**; the HarmonyOS SDK reads those two plus **on-error session capture**. None of them has Session Replay, and the other values have no effect. Every SDK has to opt in with `remoteConfigurationEnabled: true` at initialization (off by default; an application that has not opted in never requests the configuration). Minimum versions: - iOS: SDK 0.6.0. See [iOS SDK Advanced Configuration](/en/rum/sdk/ios/advanced-config#remote-configuration). - Android: SDK 0.7.0. See [Android SDK Advanced Configuration](/en/rum/sdk/android/advanced-config#remote-configuration-adjust-the-sample-rate-from-the-console). +- HarmonyOS: enable remote configuration at initialization (see [HarmonyOS SDK Advanced Configuration](/en/rum/sdk/harmony/advanced-config#remote-configuration) for the SDK version requirements). - Flutter: `flashcat_flutter_plugin` 0.2.0. See [Flutter SDK Advanced Configuration](/en/rum/sdk/flutter/advanced-config#remote-configuration). diff --git a/en/rum/sdk/harmony/advanced-config.mdx b/en/rum/sdk/harmony/advanced-config.mdx index 5a9e92fa6..9b1a24c49 100644 --- a/en/rum/sdk/harmony/advanced-config.mdx +++ b/en/rum/sdk/harmony/advanced-config.mdx @@ -1,10 +1,10 @@ --- title: "HarmonyOS SDK advanced configuration" -description: "Configure HarmonyOS RUM SDK sampling, tracking consent, event mapping, Trace, crash reporting, and symbol upload" -keywords: ["RUM", "HarmonyOS SDK", "advanced configuration", "Trace", "Crash", "Sourcemap"] +description: "Configure HarmonyOS RUM SDK sampling and remote configuration, tracking consent, event mapping, Trace, crash reporting, and symbol upload" +keywords: ["RUM", "HarmonyOS SDK", "advanced configuration", "remote configuration", "Trace", "Crash", "Sourcemap"] --- -This page describes core configuration, RUM configuration, privacy controls, Trace correlation, crash reporting, and symbol upload for the HarmonyOS SDK. All options come from the current ArkTS SDK public API. +This page describes core configuration, RUM configuration, remote configuration, privacy controls, Trace correlation, crash reporting, and symbol upload for the HarmonyOS SDK. All options come from the current ArkTS SDK public API. ## Core configuration @@ -205,6 +205,51 @@ const rumConfig = new RumConfigurationBuilder('') The event mapper runs on the SDK write path. Keep it fast, synchronous, and non-throwing. The SDK catches mapper errors and preserves the original event, but expensive logic increases client overhead. +## Remote configuration + +The session sample rate can be adjusted online in the console under **Application Management → Remote Configuration**, with no code change and no new release. The feature is off by default and has to be enabled at initialization: + +```ts +import { FlashcatRum, RumConfigurationBuilder } from '@flashcatcloud/rum'; + +FlashcatRum.enable( + new RumConfigurationBuilder('') + .setSessionSampleRate(100) // the rate used until the console publishes one + .setRemoteConfigurationEnabled(true) // let the console adjust the sample rate and on-error capture + .build() +); +``` + +Once enabled: + +- The SDK requests the configuration once at start-up and once whenever a new session begins. What it receives applies to the **next new session**; a session already running is unaffected, and the request never blocks session creation. +- A sample rate **crossing zero** (from 0 to a non-zero rate, or the other way round) ends the current session immediately so the new rate redraws it — an emergency stop or restart does not have to wait for the session to rotate. Any other change waits for the next new session. (The protocol's reserved "immediate" activation also ends the session early, but the console cannot select it yet.) +- Fetched values are persisted locally, so the first session after a cold start is drawn under what was last published. When nothing has ever been fetched, or the console switched remote configuration off, the value set at initialization with `setSessionSampleRate` applies. +- A request that fails, times out or comes back unreadable keeps the values already in force; nothing is wiped. The SDK retries about 5 seconds later and once more about 60 seconds after that (both with ±20% jitter), then waits for the next session or the next launch. +- The HarmonyOS SDK reads only the **session sample rate**, **on-error session capture** (`sessionOnError`) and **custom configuration keys**; the other fields have no effect. There is no Session Replay, so the replay and Trace switches never appear for a HarmonyOS application. +- On-error capture is the same switch as `setSessionOnError` at initialization: a value published from the console overrides the init value for the sessions drawn afterwards. An SDK that does not recognise the field ignores it, and on-error capture stays whatever initialization set. + +Sessions kept by on-error capture report a session sample rate of `0` and carry `session.sampled_for_error: true`; candidate sessions that never report an error are not uploaded and are not billed. See `session_sampled_for_error` in [Data query syntax guide](/en/rum/explorer/data-query) for how to filter them. + + +On a private deployment the configuration endpoint sits beside the RUM intake address at the `/api/v2/rum/config` path (if the intake address is `https://host/api/v2/rum`, the configuration endpoint is `https://host/api/v2/rum/config`). With `setCustomEndpoint()`, make sure your gateway lets that path through. + + +Custom configuration keys are read with `GlobalRumMonitor.get().getRemoteConfig()`, which returns a decoded object; it returns `null` when remote configuration is off, when the console has not set the field, or before a configuration has arrived: + +```ts +import { GlobalRumMonitor } from '@flashcatcloud/rum'; + +const custom = GlobalRumMonitor.get().getRemoteConfig(); +const debugUsers = custom?.['debugUsers'] as string[] | undefined; +``` + + +Custom entries are delivered to clients and are readable by anyone holding the client token. Never put secrets, access tokens, or personally sensitive information in them. + + +The console-side fields, publishing, and activation are covered in [Application Management · Remote Configuration](/en/rum/quickstart/app-management#remote-configuration). + ## Global attributes and user information Global attributes are merged into the `context` object on subsequent events. diff --git a/zh/ai-sre/im.mdx b/zh/ai-sre/im.mdx index 3e1f492c6..cbd017157 100644 --- a/zh/ai-sre/im.mdx +++ b/zh/ai-sre/im.mdx @@ -76,13 +76,13 @@ IM 交互依赖您已在 Flashduty 中接入对应平台的机器人（用于告 | 平台 | 表情池（随机取一个） | | --- | --- | -| Slack | eyes、thinking_face、hourglass_flowing_sand、mag、zap | -| 飞书 / Lark | Typing、THINKING、Get、OnIt | -| 钉钉 / DingTalk | 平台内置表情：思考、收到、Get | +| Slack | eyes、hourglass_flowing_sand | +| 飞书 / Lark | Typing、OneSecond | +| 钉钉 / DingTalk | 平台内置表情：专注、忙疯了 | Slack 除此之外还会显示一条原生的“正在处理”状态，与表情回执并存。 -答案送达后，回执会被移除。单次移除失败（平台抖动、限流）不会让表情永远留在消息上：下一次成功投递会按**当初贴上的那个表情**重试移除，卡住的回执最终都会被清掉。 +答案送达后，回执会被移除。单次移除失败（平台抖动、限流）不会让表情永远留在消息上：下一次成功投递会按**当初贴上的那个表情**重试移除，卡住的回执最终都会被清掉。更早（逐条记账上线前）贴上的回执没有记录当时用的是哪个表情，会按该平台的固定兜底值重试移除（Slack 为 eyes、飞书为 Typing、钉钉为 思考）。 企业微信没有表情接口，它的“处理中”回执是一条占位消息（随机的一句“收到，处理中⋯⋯”），随后被任务清单卡片与最终回答就地替换。 diff --git a/zh/changelog/changelog.mdx b/zh/changelog/changelog.mdx index aa50f3ba3..3721f4c7b 100644 --- a/zh/changelog/changelog.mdx +++ b/zh/changelog/changelog.mdx @@ -4,6 +4,39 @@ description: "本页面记录 Flashduty 产品的重要更新和功能发布" keywords: ["更新日志", "产品发布", "功能更新", "Flashduty", "版本记录"] --- + + +### 调查入口：从告警一键跳到仪表盘或查询工作台 + +告警规则表单新增第六个区块 **调查入口**：为规则预置最多 **20** 个跳转目标，每个目标是一条 **添加仪表盘入口**（选定仪表盘、**定位到** 整个仪表盘 / 标签页 / 分组 / 图表，并为仪表盘变量填 **变量取值**）或一条 **添加查询入口**（数据源 + 查询类型 + 查询语句 + 查询参数；数据源留空即用告警事件的数据源）。每条入口可写 **调查用途**（一句话说明它能确认什么）与 **时间范围**（告警前 / 告警后各多少分钟，都不小于 0，且两者之和必须大于 0），拖动可调整展示顺序。变量取值按 Go 模板渲染，上下文只有 `$labels`（告警的原始数据标签，不含规则附加标签）与 `$datasource`（事件数据源的 id / name / type / address）；查询语句原样渲染，不会自动加引号或转义，查询参数不做模板渲染。填好后可用 **预览跳转** 挑一条该规则的活跃告警试跳一次。 + +配置生效后，Monit 告警规则产生的告警与故障，其详情页右侧会在 **属性** 之后出现 **排查入口** 区块：按事件快照列出入口（默认显示 3 条，「还有 N 个」可展开），每条给出用途、数据源、变量与查询时间范围，下方附 **关联告警规则** 以及规则 **主查询 / 关联查询** 在触发时刻的值、结果与完整表达式；关联告警列表每行的 **排查** 浮层、监控的活跃告警详情抽屉里也能看到同一份入口。入口取自事件快照而非规则当前配置——规则改了不会改变已产生告警的入口，配置生效前产生的告警则完全没有入口。私有化部署需要留意版本：保存带调查入口的规则，要求该规则匹配到的数据源所在集群内 **所有** 已注册的 monit-edge 都是 `v0.75.3` 或以上，否则保存会被拒绝；快照渲染失败时页面会就地说明原因（规则已删除 / Edge 需升级 / 配置有误 / 内容超过 8KB）。详见[告警规则 · 调查入口](/zh/monitors/alert-rules/investigation-entries)与[检索与查看故障](/zh/on-call/incident/search-view-incident)。 + +### 告警聚合：三选一，创建协作空间时即可配置 + +告警聚合从「一个开关 + 两种模式」改为三张互斥卡片 **智能聚合** / **规则聚合** / **不聚合**，每张卡片带一句说明，当前生效的一张标 **默认**：智能聚合「根据标题、描述和标签内容的相似程度自动判断」，规则聚合「字段值相同的告警进入同一故障，结果明确、可预览」，不聚合「每条告警创建一个故障，不加入已有故障」。可用方式按套餐收敛：**智能聚合** 需专业版及以上（私有化部署同样提供），**规则聚合** 需标准版及以上，免费版只开放 **不聚合**；不可用的卡片置灰并提示「当前订阅暂不支持该聚合方式」。 + +创建协作空间的向导新增第四步 **告警聚合**，新建的空间从创建起就带聚合配置：默认方式按套餐预选（专业版与私有化 → 智能聚合，标准版 → 规则聚合，免费版 → 不聚合），可当场调整 **聚合字段**（规则聚合）或 **参与判断的信息**（智能聚合）、**聚合时间**（持续到故障关闭 / 固定 60 分钟），以及 **高级配置** 里的 **严格聚合**、**参与判断的信息** 与 **风暴提醒**。规则聚合的两个子选项改名为 **所有告警使用同一规则** / **不同告警使用不同规则**，后备维度从「默认维度」改成 **未匹配任何规则时**——按下面的默认字段聚合，不设置则不聚合。新建空间同时默认开启抖动检测、模式为 **仅提醒**（观测窗口 60 分钟、状态变化 4 次）。详见[告警降噪](/zh/on-call/channel/noise-reduction)与[创建与管理](/zh/on-call/channel/create-edit)。 + +### 标签面板重做：系统标签收起、相关链接提到顶部 + +故障与告警详情的标签面板换了显示逻辑。原来的 **隐藏 Meta Label** 改成按来源识别系统标签的 **隐藏系统标签 / 显示系统标签**（带 Eye 图标），默认收起：Monit 告警只把 `__alert_rule_` / `__entity_alert_` 前缀当系统标签，其它来源沿用 `__...__` 包夹以及 `__alert_rule_` / `__entity_alert_` / `__flashduty_` 前缀。收起时列表底部是一条虚线提示「N 个系统标签已收起（keys…）」，展开后是独立的 **系统标签** 分区（不参与拖拽排序），标题旁的计数徽标改为标签总数。 + +值为 http(s) 链接、且不是图片的标签不再留在列表里，而是提到列表上方的 **相关链接** 按钮条：按钮名按 key 映射（查看来源 / Runbook / 去静默 / 打开仪表盘 / 打开面板 / 查看查询 / 查看日志 / 查看告警 / 查看规则 / 告警历史），未列到的显示「key · 域名」。标签值新增四类渲染：图片链接显示缩略图（点击开原图）、`arn:...` 显示资源段与服务 / 区域、时间戳按账户时区格式化并附「x 前」、查询类 key（promql / logql / query / sql 等）显示为等宽代码块。系统标签的值悬停可看 **解读卡片**，把告警规则 ID、目录、数据源、事件类型等机器标签翻译成人话并给出跳转。标签行右侧原来的 **去查询** 图标已移除——要看告警当时的查询，请从系统标签的解读卡片、详情页右侧的 **排查入口**、或关联告警行的 **排查** 浮层进入。详见[什么是故障](/zh/on-call/incident/what-is-incident#故障标签)与[检索与查看故障](/zh/on-call/incident/search-view-incident)。 + +### 定时通知：周期可选 每天 / 每周 / 每月 + +值班表的 **定时通知** 不再只是「每天固定时间」：周期可选 **每天 / 每周 / 每月**，每周多选星期几、每月多选每月第几日（1–31），仍在所选日期的 HH:MM 按值班表时区发送。所选日期在当月不存在时（例如选 31 日遇上只有 30 天的月份），该月不发送通知；周 / 月周期至少要选一个日期才能保存。详见[值班管理](/zh/on-call/configuration/schedule)。 + +### 仪表盘：全局搜索、面板查询方式与模板校验 + +仪表盘列表页右上角新增 **全局搜索**：跨当前账号所有可读目录搜仪表盘（权限由后端过滤），按标题或描述匹配、多个关键词用空格分隔，结果带目录路径以便区分同名仪表盘，每页 20 条、失败可重试；它的搜索状态只活在弹窗里，与列表页「搜索当前目录」互不影响，也不写进页面地址。 + +面板编辑器的查询 **选项** 里，Loki 的 **表格** 与 **单值** 面板现在可以自己选 **查询方式**：**区间** 按步长逐点计算画趋势、**即时** 整个时间范围算一个值（`[$__auto]` 取整段范围），表格默认即时、单值默认区间；Loki 时序仍固定区间，Loki 即时不接受 **最小步长**。查询类模板变量按数据源给出对应表单：MySQL 写 SQL、Loki 填 stream selector 与 label 名、其它数据源用 Prometheus 标签。查询表达式还会在编辑器里提前指出三类保存时会被拒绝的写法——多选或「可选全部」的变量写在精确匹配里、引用了未定义的变量、内置变量在当前数据源与查询方式下不可用；精确匹配那条可以一键 **改为正则匹配**。**预览候选** 也改为带上当前已选的变量值与面板时间范围去取数，预览结果与看板实际渲染一致。详见[仪表盘](/zh/monitors/dashboards/dashboards)。 + + + + ### AI SRE 自动化新增「作战室创建触发」 diff --git a/zh/developer/go-sdk.mdx b/zh/developer/go-sdk.mdx index 2a3d485b6..660a0539b 100644 --- a/zh/developer/go-sdk.mdx +++ b/zh/developer/go-sdk.mdx @@ -278,7 +278,7 @@ zero := inc.StartTime.IsZero() // 是否为未设置哨兵 同样属于 `AlertRuleV2`（`AlertRules.ReadInfoV2` / `WriteCreateV2` / `WriteUpdateV2` 的返回类型）的 `investigation_targets` 也换了形状，仍在发送旧字段的调用方需要一并改： -- 字段本身是 `[]InvestigationTarget`，最多 20 项且不允许重复；更新接口按 presence 处理——省略保留原配置，传 `[]` 清空。每个入口可带可选的 `purpose`：一句话纯文本，说明该入口帮助确认什么排查意图（≤512 字节，不是模板，不参与告警身份）。 +- 字段本身是 `[]InvestigationTarget`，最多 20 项且不允许重复；整个列表序列化后还不得超过 **32 KiB**（`MaxInvestigationTargetsBytes = 32 * 1024`，超限报 `investigation_targets must not exceed 32768 bytes`）。更新接口按 presence 处理——省略保留原配置，传 `[]` 清空。每个入口可带可选的 `purpose`：一句话纯文本，说明该入口帮助确认什么排查意图（**文本里不要写换行**，服务端按 ≤512 字节校验，且必须是合法 UTF-8、不含控制字符；控制台的输入框限 200 个字符，因此 API 侧可以比控制台多填一些，但 200 个中文字符就可能超过 512 字节）。`purpose` 不是模板，也不参与告警身份与去重。 - 每个入口是**封闭的 tagged union**，`Kind` 决定必须提供哪个子对象：`dashboard`（打开仪表盘面板）必须给 `Dashboard`，`query`（打开 Explore 查询）必须给 `Query`，提供另一个会被拒绝，入口内出现未知字段同样会被拒绝。 - `TimeRange`（`InvestigationTimeRange`：`BeforeSeconds` 与 `AfterSeconds`）在**每个**已保存的入口上都必填——两个方向都非负，且至少一个大于 0。 - `Dashboard` 入口（`DashboardInvestigationTarget`）的变量由原来的 `VariableBindings`（键为仪表盘变量名，值为 `{source: event_label, key: 标签名}`）换成 `Variables`：`map[string]string`，键为变量名、值为字面取值，可用 `{{ }}` 模板引用事件标签（旧类型 `InvestigationVariableBinding` 已不存在）。`DashboardID` 与 `Variables` 必填，`TargetID` 可选；`DashboardID` 与 `TargetID` 都必须是规范的 UUIDv7。 diff --git a/zh/monitors/alert-rules/active-alerts.mdx b/zh/monitors/alert-rules/active-alerts.mdx index ec0b811a0..8a1e9cf22 100644 --- a/zh/monitors/alert-rules/active-alerts.mdx +++ b/zh/monitors/alert-rules/active-alerts.mdx @@ -60,6 +60,7 @@ keywords: ["活跃告警", "告警规则", "告警列表", "严重程度", "标 列表中每一行都提供**查看详情**入口（行尾的眼睛图标），打开活跃告警详情抽屉，内容分为以下区块： - **告警概览**：当前状态（活跃）、级别、活跃时长、通知次数 +- **调查入口**：该告警所属规则的[调查入口](/zh/monitors/alert-rules/investigation-entries)快照，每条一行，点击可跳到仪表盘或查询工作台。这一块渲染的是**告警产生那一刻的快照**，不是规则当前配置：之后修改规则不会改变已接受告警显示的内容；配置生效前产生的告警会显示 `该告警没有调查入口快照，请选择配置生效后产生的告警`。渲染失败的入口（变量渲染失败、查询渲染失败因而未执行，或整条事件没有生成快照）仍会列出，但不给跳转链接，并带一个红色的 `入口异常` 标记 - **时间信息**：首次触发、最近评估、最近通知、最后更新 - **规则与来源**：告警规则、检测方式（阈值判定 / 数据存在 / 数据缺失）、数据源名称、数据源类型、实例类型、查询 Ref - **当前值**：触发告警的查询结果值快照 diff --git a/zh/monitors/alert-rules/investigation-entries.mdx b/zh/monitors/alert-rules/investigation-entries.mdx new file mode 100644 index 000000000..627769f32 --- /dev/null +++ b/zh/monitors/alert-rules/investigation-entries.mdx @@ -0,0 +1,200 @@ +--- +title: "调查入口" +description: "为 Monitors 告警规则配置调查入口：从告警一跳直达仪表盘或查询工作台的初始查询，含入口字段、模板变量、校验限制与快照语义。" +keywords: ["调查入口", "排查入口", "告警规则", "仪表盘入口", "查询入口", "Go Template", "快照"] +--- + +告警规则可以携带一组**调查入口**（Investigation entries）。每个入口是一个预配置的跳转目标：打开某个仪表盘，或用查询工作台打开一份已经写好、并被告警标签渲染过的初始查询。值班人员从一条告警出发就能直接看到该看的图或该查的数据，不必再手写查询。 + +入口配置在告警规则表单的**第 6 个区块「调查入口」**，随规则一起保存；入口只在**告警事件产生的那一刻**渲染成快照并随事件下发，之后规则再改也不会影响已经接受的告警。 + + +保存调查入口需要 monit-edge `v0.75.3` 或以上版本。保存时会检查该规则匹配到的数据源所在集群内**所有**活跃实例：只要有实例低于 `v0.75.3`，保存即被拒绝。详见[保存时的 Edge 版本要求](#保存时的-edge-版本要求)。 + + +## 工作方式 + +一个告警规则可以保存多个调查入口。每条入口包含三部分：入口类型（仪表盘或查询）、该类型的配置、以及一个相对于告警事件时间的时间窗口。 + +- **入口是弱导航引用。** 保存配置和渲染快照都不会执行查询，也不会读取仪表盘内容；入口不参与告警判定、告警身份、实例身份或生命周期，也不触发任何自动调查任务。 +- **入口跟随事件的数据源。** 一条规则可以按数据源类型与名称通配匹配多个数据源，但每个告警事件只来自其中一个。查询入口默认在**事件自己的数据源**上执行，因此跳过去看到的是触发告警的那个数据源，而不是某个固定或默认数据源；也可以显式指定其他数据源（例如用日志数据源做下钻）。 +- **渲染发生在告警入库时。** monit-webapi 在接受事件时，用最终事件时间、事件的原始数据标签和事件数据源，把规则上当时配置的入口渲染成一份快照（Investigation Context），随事件一并保存与投递。**活跃告警**详情抽屉里的调查入口区块、**故障**详情综合信息面板里的排查入口区块（见[故障详情](/zh/on-call/incident/search-view-incident#排查入口)）、以及 AI SRE 读的都是这同一份快照。 +- **入口名在两边叫法不同**：Monitors 里这一块叫**调查入口**，故障详情里叫**排查入口**，两者都是同一份事件快照。 +- **顺序只影响展示。** 入口可以拖动排序，但第一项没有默认、主要或推荐语义；顺序不进入告警执行或生命周期。 + +## 入口类型 + +| 入口类型 | 按钮 | 跳转到 | 说明 | +|---------|------|--------|------| +| **仪表盘入口** | 添加仪表盘入口 | 仪表盘查看器 | 可定位到整个仪表盘、某个标签页、某个分组或某个图表，并为该仪表盘的模板变量指定取值 | +| **查询入口** | 添加查询入口 | 查询工作台 | 保存一份可编辑的初始查询（查询类型 + 查询语句 + 查询参数），并可指定在哪个数据源上执行 | + +两类入口都不支持 Runbook、工单或任意 URL。 + +## 添加与编辑入口 + +**菜单入口**：配置告警规则的表单 → 区块 6「调查入口」。 + +1. 点击 **添加仪表盘入口** 或 **添加查询入口**，打开入口编辑弹窗。弹窗标题会区分是新增还是编辑（添加仪表盘入口 / 编辑仪表盘入口 / 添加查询入口 / 编辑查询入口）。 +2. 填写**调查用途**和**时间范围**（两类入口通用），再填写该类型的字段（见下文）。 +3. 点击 **确认**，入口加入规则表单。**确认只把入口加入表单，要保存规则后才生效**。 +4. 规则列表上每条入口右侧有三个操作：**预览跳转**（眼睛图标）、**编辑**（铅笔图标）、**删除**（垃圾桶图标）。查看已保存规则的详情时，编辑按钮变成 **详情**，弹窗底部只有 **关闭**。 + +已添加的入口以列表展示：拖动最左侧的拖拽手柄可以调整顺序，列表标题取**调查用途**；没有写用途时，仪表盘入口显示仪表盘标题（读不到时显示仪表盘 ID），查询入口显示查询语句。 + +入口数量上限为 **20 个**：达到 20 个后两个添加按钮变为禁用，并在旁边提示 `最多 20 个调查入口`（详见[校验与限制](#校验与限制)）。 + +## 通用字段 + +| 字段 | 必填 | 说明 | +|------|------|------| +| **调查用途** | 否 | 一句话说明这个入口帮助确认什么。单行纯文本，换行符会被替换为空格；控制台把输入框限制为 200 个字符，后端同时按 **≤512 字节** 校验。用途**不渲染模板**，也不参与去重身份（两个入口只有用途不同仍然算重复）。它面向值班人员展示，也供 AI SRE 判断每个入口的意图 | +| **时间范围** | 是 | 「**告警前** N **分钟，至告警后** M **分钟**」，新建入口默认为告警前 60 分钟、告警后 0 分钟。两个方向都必须非负，且至少一个大于 0 | + +时间范围的语义： + +- 锚点是**告警事件时间**：开始时间 = 事件时间 − 告警前时长，结束时间 = 事件时间 + 告警后时长。 +- 窗口完全按您配置的值写进快照，之后无论什么时候打开都不会随当前时间漂移；进入仪表盘或工作台后可以临时调整时间范围，但页面里的调整不会回写规则或已产生的快照。 +- 允许结束时间晚于当前时刻（配置了告警后时长的入口会这样），告警一产生就能打开，不等待后续数据。 +- 系统不推导、不提示、也不校验告警的计算窗口是否被覆盖。 + +## 仪表盘入口的字段 + +| 字段 | 说明 | +|------|------| +| **仪表盘** | 按标题或描述搜索并选择仪表盘；选中后下方会显示它所在的分组路径。**更换仪表盘会清空定位对象与变量取值**（它们都属于旧仪表盘） | +| **定位到** | `整个仪表盘`，或仪表盘内的某个标签页 / 分组 / 图表，选项后跟完整路径面包屑。整个仪表盘的入口打开仪表盘本身 | +| **变量取值** | 该仪表盘的每个模板变量一个输入框；留空表示使用仪表盘自己的默认值 | + +**定位到**的失效处理：如果定位对象在仪表盘里已不存在（被删除或改名），字段会提示 `已不存在的对象（）`，下方同时给出警告 `定位对象在仪表盘中已不存在，将打开仪表盘默认页签`——跳过去时打开仪表盘默认页签，不会失败。仪表盘本身加载失败（已删除或您无权查看）时，字段区显示 `仪表盘加载失败，可能已被删除或您无权查看`，此时定位到不可选。 + +**变量取值**的规则： + +- 仪表盘没有变量时显示 `该仪表盘没有变量`。 +- 变量取值统一按 **Go template** 渲染，可用变量见[模板变量](#模板变量)。数据源类变量会标注 `（数据源）`，占位提示为 `{{ $datasource.id }}`；普通变量的占位提示为 `留空使用仪表盘默认值，例如 {{ $labels.<变量名> }}`。 +- 留空 = 未配置，仪表盘按自己的规则取默认值；配置了但渲染失败或渲染为空 = 保持 unresolved（不会回退默认值），并在入口上显示错误。 +- 已配置、但仪表盘里已经不存在（或改名）的变量仍会列出来并标记 `仪表盘中已不存在`，方便您清理；否则它会影响仪表盘的变量解析而您看不到。 +- 变量的删除、改名、类型变化或候选失效不会反向更新规则。 + +## 查询入口的字段 + +| 字段 | 说明 | +|------|------| +| **数据源** | 默认是 `告警事件的数据源`（查询按规则的数据源类型书写），也可以选择一个具体数据源。当前规则的数据源类型不支持查询工作台时，`告警事件的数据源` 一项被禁用并显示 `当前规则类型不支持`，此时入口必须显式指定数据源。**更换数据源会重置查询**（查询语言变了，旧语句没有意义） | +| **查询类型** | 只有多查询类型的数据源才出现这一行（Prometheus：仅图表 / 仅原始；Loki：Range / Instant；VictoriaLogs：原始日志 / 即时统计 / 趋势统计）。Prometheus 的「图表 + 原始」不会出现在这里，因为它对应两次执行，一份查询存不下。SQL 类数据源与 SLS、腾讯云 CLS 都只有一种查询方式，因此没有这一行 | +| **初始查询** | 查询语句编辑器，写法与查询工作台一致，可按数据源类型使用补全。整个表达式按 Go template 渲染，**原样输出，不自动加引号或转义** | +| **查询参数** | 数据源的命名参数，按数据源类型给出（如返回条数、检索方向、最小 step（秒）、SLS 的项目 / 日志库、腾讯云 CLS 的地域 / 日志主题 / 语法）。参数值**不做模板渲染**——key 或 value 里出现 `{{` 会被拒绝（`query args do not support templates`） | + +选择了事件数据源时，规则类型不是工作台支持的类型会显示 `请先在「数据源与查询」中选择数据源类型，或为该入口指定数据源`；指定的数据源已被删除或您无权使用时会显示 `所选数据源不可用`。数据源的真实类型、权限与专属限制由工作台在打开或执行时按当前用户重新校验。 + +## 模板变量 + +调查入口的模板上下文**只有两个变量**： + +| 变量 | 类型 | 说明 | +|------|------|------| +| `$labels` | `map[string]string` | 告警事件的**原始数据标签**。不含规则上配置的附加标签，也不含外部标签增强返回的标签，且不过滤标签名 | +| `$datasource` | `map[string]string` | 事件来源的数据源，固定键：`id`（十进制数据源 ID）、`name`、`type`、`address` | + +- 简单标签直接取值：`{{ $labels.service }}`。标签名含点等特殊字符时用 `{{ index $labels "service.name" }}`。 +- **访问缺失的标签或 `$datasource` 不存在的键会明确报错**（`index` 访问同理），不会静默产出空字符串——否则会变成一次没有过滤条件的查询。 +- 点号（`.`）只表示 `range` / `with` 等局部数据上下文，不代表完整告警事件；`$values`、`$value`、`$annotations`、`$appendLabels` 等[备注描述](/zh/monitors/alert-rules/description-template)里可用的变量在这里都不可用，也不能通过根对象绕过。 +- 支持 Go template 的条件、循环、局部变量与内置函数；只渲染**一次**，模板渲染结果里的 `{{ }}` 不会被再次执行。 + +仪表盘变量示例： + +```gotemplate +{{ $labels.service_name }} +{{ $datasource.id }} +``` + +查询语句示例（VictoriaLogs）： + +```text +event_name:="webhook.attempt.completed" +service:="{{ $labels.service_name }}" +outcome:="failure" +``` + +**查询表达式自己负责引号与转义。** 模板只产出值本身，`service:="{{ ... }}"` 里的引号是 LogsQL 语法的一部分，必须由表达式自己写。需要转义时请显式使用有固定语义的函数，例如 `replace`（字面量替换）、`regexQuoteMeta`（正则元字符）、`urlquery` / `html` / `js`；系统不按数据源方言自动判断转义方式。渲染失败或渲染结果不满足查询载荷要求时，该入口保留初始模板与错误，**不生成可执行查询、也不执行**。 + +## 预览跳转 + +点击入口右侧的眼睛图标打开 **预览调查入口** 弹窗，它按真实事件的快照渲染这个入口，用来在保存前确认跳转是否符合预期。 + +- 前置条件：**规则必须已经保存**（否则提示 `请先保存规则，产生告警后再预览`），并且该规则**当前有活跃告警**（否则提示 `该规则暂无活跃告警，产生告警后可预览`）。弹窗顶部从该规则的活跃告警里选一条作样本，超过 20 条时可以翻页。 +- 预览用的是所选告警的**事件快照**，**不包含表单里尚未保存的修改**；因此要先保存规则、等它产生告警，才能预览新改的配置。 +- 弹窗里点入口再打开目标（新页签）。如果这条告警没有与该入口对应的快照，会提示 `该告警中没有与此入口对应的快照，请选择配置生效后产生的告警`；整条告警都没有快照时提示 `该告警没有调查入口快照，请选择配置生效后产生的告警`。 + +## 校验与限制 + +| 限制 | 值 | 说明 | +|------|-----|------| +| 入口数量 | 最多 **20 个** | 控制台提示 `调查入口最多 20 个`；接口错误为 `investigation_targets must not contain more than 20 items` | +| 配置总量 | 最多 **32 KiB** | 按整个入口列表序列化后的字节数计算。控制台提示 `调查入口配置总量超过 32 KiB，请精简查询或变量模板`；接口错误为 `investigation_targets must not exceed 32768 bytes` | +| 仪表盘入口 | 必须选择仪表盘 | `第 N 个调查入口未选择仪表盘` | +| 查询入口 | 必须填写查询语句 | `第 N 个调查入口未填写查询语句` | +| 查询入口 | 按规则类型无法在工作台查询时，必须显式指定数据源 | `第 N 个调查入口需要指定数据源：当前规则的数据源类型不支持查询工作台` | +| 时间范围 | 两个方向非负，且长度大于 0 | `第 N 个调查入口的时间范围必须大于 0` | +| 调查用途 | 控制台输入框 200 个字符，后端 **≤512 字节** | `第 N 个调查入口的调查用途过长`。200 个中文字符可能超过 512 字节，此时同样会被拦下 | +| 去重 | 不允许重复 | `第 N 个调查入口与第 first 个重复` | + +去重的身份判定： + +- **仪表盘入口**：同一仪表盘 + 同一定位对象即为重复，**与变量取值、时间范围无关**。重复项不能用来表达变量 fallback 或多实例。 +- **查询入口**：按标准化后的数据源、查询（模式、表达式、参数、最小 step）与时间范围判重；未指定数据源（使用事件数据源）作为独立取值参与比较。同一数据源上可以配置多份**不同**的查询。 + +这些校验同时在两个地方执行：入口弹窗里（只校验当前这一项，方便逐项修复），以及保存规则时（整组校验，错误文案显示在区块下方）。接口侧还会校验仪表盘 ID 与定位对象必须是规范的 UUIDv7、变量名合法、模板语法可解析，以及未知字段会被拒绝。 + +## 保存时的 Edge 版本要求 + +调查入口需要 monit-edge **`v0.75.3` 或以上版本**。为了引导升级，版本门控放在**保存时**，事件处理时不检查版本： + +- **触发条件**：保存后的规则带有非空入口，并且本次请求显式提交了非空入口，或者在保留原有入口的同时修改了数据源范围（数据源类型、名称通配或精确绑定）。未配置入口、显式传空数组、以及只改其他字段的请求都不检查。 +- **检查范围**：解析该规则当前匹配的全部数据源，取其所在 Edge 集群的**活跃实例**。没有任何活跃实例的数据源会被跳过；规则当前没有匹配到任何数据源时直接允许保存。 +- **通过条件**：所有被检查实例的版本 ≥ `v0.75.3`。版本无法识别视为不满足。 +- **拒绝行为**：不保存任何字段，返回明确的升级错误并列出最低版本，以及不满足的数据源、Edge 集群、实例 IP 与版本（数量有界）。错误信息形如：`investigation_targets require monit-edge v0.75.3 or later on every active instance serving the rule's datasources; upgrade cluster "<集群名>" <实例 IP>:<端口> (v0.75.2)`。 +- 该门控覆盖全部写入口：创建、更新、可修改入口或数据源范围的批量字段更新，以及原生 Bundle 与历史 JSON 导入；外部格式（Prometheus、Nightingale 等）导入的规则入口固定为空数组，不受影响。 +- 保存之后再出现低版本实例、或 Edge 降级，都**不会**影响已保存的规则；之后再提交入口或修改数据源范围时才会重新检查。 + +## 快照语义与失败处理 + +**入口来自事件快照，不来自规则当前配置。** 告警被接受时渲染一次，之后： + +- 规则改了入口，**已经接受的告警**（活跃告警详情、故障详情里的排查入口区块）显示的仍是老快照； +- 重复通知或终态事件沿用同一份快照，只把每个入口的窗口按事件时间差整体平移，不重新读取规则； +- 规则被删除也不会移除历史快照——故障侧会显示 `告警规则已被删除，无法生成排查入口`。 + +**配置生效前产生的告警没有快照。** 在规则保存入口之前就已经产生的告警，详情里会显示 `该告警没有调查入口快照，请选择配置生效后产生的告警`。请用配置生效后新产生的告警验证。 + +**整条事件渲染失败时不生成快照**，改为携带一个有界错误码： + +| 错误码 | 含义 | 界面文案 | +|--------|------|---------| +| `rule_missing` | 规则已不存在 | 告警规则已不存在，无法生成调查入口 | +| `edge_upgrade_required` | 事件来自不携带数据源 ID 的旧协议（Alert Rule Event v1 及更早） | 上报该事件的 Edge 版本过低，未生成调查入口，请升级 Edge | +| `invalid_config` | 配置结构非法、事件时间无效，或按事件时间计算后的窗口超出可表示范围 | 调查入口配置或事件时间无效，未生成调查入口 | +| `payload_limit` | 渲染结果超过容量上限（快照本身超过 64 KiB） | 调查入口渲染结果超过容量上限，未生成调查入口 | + +**单项渲染失败不丢弃入口**：仪表盘变量渲染失败时，该变量保留为未解析并显示 `变量 <名称> 渲染失败：<原因>`；查询语句渲染失败时，该入口不会生成可执行查询、不会执行，并显示 `查询渲染失败，未执行：<原因>`。这类入口仍然列出来，但带一个红色的 `入口异常` 标记，也不给跳转链接。其余入口照常工作。 + +**权限在目的端重新校验。** 快照的可见性跟随告警事件本身，生成时不按仪表盘分组或数据源权限过滤；真正打开仪表盘或工作台时按**当前用户**重新校验，无权或已删除的目标沿用目的端的报错，不会回退到其他资源。 + +**投递到 On-call 的快照另有 8 KiB 上限。** 完整快照随告警事件以 `__alert_rule_investigation_context` 标签投递，标签值超过 8 KiB 时整体降级为 `payload_limit`（故障详情显示提示文案，不截断），此时完整的快照仍可在 Monitors 的活跃告警详情中查看。 + +## 相关页面 + + + + 活跃告警详情抽屉里的调查入口区块，按事件快照展示入口。 + + + 故障综合信息面板里的排查入口区块如何渲染快照。 + + + 告警事件备注里的 Go Template 变量，与调查入口的上下文不同。 + + + 告警规则表单六个区块的整体说明。 + + diff --git a/zh/monitors/dashboards/dashboards.mdx b/zh/monitors/dashboards/dashboards.mdx index 7c789130d..0bb45debb 100644 --- a/zh/monitors/dashboards/dashboards.mdx +++ b/zh/monitors/dashboards/dashboards.mdx @@ -17,8 +17,8 @@ keywords: ["仪表盘", "Dashboard", "面板", "模板变量", "同环比", "版 页面左侧是与告警规则共用的目录树，右侧是当前目录下的仪表盘。目录的创建、重命名、移动和删除都在树上完成，规则见[文件夹管理](/zh/monitors/folders/folders)。 -- 搜索只在**当前目录**内进行。 -- 目录、搜索词和页码会保留在页面地址中，链接可以分享，从仪表盘返回列表时也会还原。 +- 左侧目录上方输入框的搜索只在**当前目录**内进行；搜索词和页码会保留在页面地址中，链接可以分享，从仪表盘返回列表时也会还原。 +- 页面右上角的 **全局搜索** 则在当前账号所有可读目录里查找仪表盘（可读范围由后端按权限过滤），不受当前所在目录限制：匹配仪表盘的**标题或描述**，多个关键词用空格分隔；每条结果给出标题、所在目录路径和描述，点击即可打开该仪表盘；结果每页 20 条，请求失败时可以点 **重试**。这个弹窗的搜索状态只存在于弹窗内，关闭即丢弃，也不会写入页面地址。 - 每行的 **更多** 菜单提供：移动到其他分组、克隆到本分组、克隆到其他分组。克隆会生成一个标题带“副本”后缀的新仪表盘，**不带历史版本**；移动或克隆到其他目录时，您需要对目标目录可读。 ## 新建与保存仪表盘 @@ -63,14 +63,14 @@ keywords: ["仪表盘", "Dashboard", "面板", "模板变量", "同环比", "版 **数据源**：支持 Prometheus、MySQL 和 Loki。可以选固定数据源，也可以选**数据源变量**，切换变量即可让整个仪表盘换数据源。 -**查询方式**由数据源和图表类型自动决定：表格取即时值，时序图和单值图取区间数据，MySQL 按时间窗口查询。 +**查询方式**决定查询怎么取数：**区间**按步长逐点计算画趋势；**即时**把整个时间范围算成一个值，此时 `[$__auto]` 取的是整段范围。多数情况由数据源和图表类型自动决定——表格取即时值，时序图和单值图取区间数据，MySQL 按时间窗口查询；Loki 的指标类面板（单值、表格，以及后续支持的仪表与柱状）则在 **查询 → 选项 → 查询方式** 里手动切换，默认单值取区间、表格取即时。Loki 的时序面板固定区间，Prometheus 与 MySQL 不提供该选择。 | 配置项 | 说明 | |--------|------| | **查询表达式** | Prometheus / Loki 面板可以使用 `$变量名` 或 `${变量名}` 引用模板变量，以及[内置时间变量](#内置时间变量)。MySQL 面板不支持变量 | | **多查询** | 只有时序图支持多条查询（`A`~`Z`）。切换到其他图表类型时需要选择保留哪一条 | | **序列名称** | 时序图中每条曲线的显示名，如 `{{instance}}` 会替换为 `instance` 标签的值；留空显示全部标签 | -| **最小步长** | Prometheus 区间查询的步长下限，默认 15s | +| **最小步长** | 区间查询的步长下限，默认 15s。Prometheus 面板与 Loki 的指标类面板（单值、表格、仪表、柱状）都提供；即时查询不接受，Loki 的日志面板也不接受 | | **取值字段** | 单值图显示的字段，区分大小写 | | **单位 / 小数位 / 阈值** | 阈值可设“越高越差”或“越低越差”，分 warning / critical 两级，按文字或背景着色 | | **表格列配置** | 为数值列设置单位、阈值和着色；背景着色可以应用到整行 | @@ -115,6 +115,18 @@ keywords: ["仪表盘", "Dashboard", "面板", "模板变量", "同环比", "版 内置时间变量只能用在**面板查询表达式**中，不能用于模板变量的候选查询，也不支持 `:raw` 之类的格式后缀。MySQL 面板不可用。用在不支持的位置时，仪表盘无法保存。 +### 模板写法的即时检查 + +在面板编辑器里写查询表达式时，编辑器会即时检查模板写法，把**保存时会被后端拒绝**的几类写法标在输入框下方，按当前数据源与查询方式判断： + +| 提示 | 含义与处理 | +|------|-----------| +| “变量 instance 是多选或可选全部，会展开成正则，`=` 要改成 `=~`，否则保存会被拒绝” | 多选、允许“全部”，或显式写作 `${变量名:regex}` 的变量会被后端展开成正则，因此不能写在精确匹配里。点提示旁的 **改为正则匹配** 可以一次改好表达式里所有被标出的匹配符：`=` → `=~`、`!=` → `!~`（LogQL 的 line filter 同理换成正则写法） | +| “未定义的变量 pod，可能拼写错误” | 表达式里的 `$xxx` / `${xxx}` 没有对应的模板变量。改正拼写，或先在变量栏的 **管理变量** 里定义它（见[模板变量](#模板变量)）；变量名后面还要跟文字时必须写成 `${变量名}_suffix`，否则会被当成一个更长的变量名 | +| “内置变量 __rate_interval 在当前数据源 / 查询方式下不可用，保存会被拒绝” | 用了该数据源与查询方式不支持的、`$__` 开头的时间变量。对照[内置时间变量](#内置时间变量)的可用范围，换变量或换查询方式 | + +变量可以带**格式后缀**，写法为 `${变量名:后缀}`。面板查询表达式（Prometheus / Loki）支持两种后缀：`:regex` 表示无论变量是否多选都按正则展开，`:raw` 表示原样插入且要求变量只有一个值。内置时间变量不接受后缀；数据链接里也可以这样写，见[点值筛选与下钻链接](#点值筛选与下钻链接)。 + ## 模板变量 变量栏位于画布上方，每个变量是一个筛选项。编辑时点击变量栏末尾的 **管理变量** 可以新增、修改或删除变量。 diff --git a/zh/monitors/explore/explore.mdx b/zh/monitors/explore/explore.mdx index 76cb540f1..506b6ba85 100644 --- a/zh/monitors/explore/explore.mdx +++ b/zh/monitors/explore/explore.mdx @@ -10,7 +10,7 @@ keywords: ["查询工作台", "Explore", "即时查询", "Prometheus", "Loki", " - **从数据源列表**：进入 **监控 → 数据源**，点击目标数据源行的“查询工作台”入口。 - **直接打开**：进入查询工作台后，在页面内选择数据源。 -- **从故障/告警标签**：在故障详情或告警详情的标签区域，查询类标签行右侧的“去查询”图标会带着告警触发时的查询和时间窗口直接打开工作台。 +- **从故障/告警详情**：在故障或告警详情页的 **排查入口** 区块、关联告警行上的 **排查** 浮层，或系统标签的悬停解读卡片里，点击入口即可带着告警触发时的查询和时间窗口打开工作台。详见[检索与查看故障](/zh/on-call/incident/search-view-incident#排查入口)。 ## 查询类型 @@ -72,7 +72,7 @@ keywords: ["查询工作台", "Explore", "即时查询", "Prometheus", "Loki", " | 参数 | 适用数据源 | 说明 | |------|-----------|------| | 返回条数（limit） | Loki / VictoriaLogs | 限制返回行数 | -| 最小 step（秒） | Prometheus | 自动 step 的下限 | +| 最小 step（秒） | Prometheus / Loki | 区间查询自动 step 的下限。工作台只为 Prometheus 提供输入框；Loki 侧的取值由仪表盘面板带入——从面板的 **在查询工作台打开** 进入时，面板设置的最小步长会一并带上（见[全屏与查询详情](/zh/monitors/dashboards/dashboards#全屏与查询详情)） | | 检索方向 | Loki / VictoriaLogs | 最新优先或最早优先 | | 项目 / 日志库 | SLS | 必填，拼入请求地址 | | 地域 / 日志主题 / 语法 | 腾讯云 CLS | 必填 | @@ -82,23 +82,26 @@ keywords: ["查询工作台", "Explore", "即时查询", "Prometheus", "Loki", " ### 内置时间变量 -Prometheus 和 Loki 的区间查询可以使用内置时间变量，让查询跟随页面选择的时间范围，不必把时间写死。写法为 `$__interval` 或 `${__interval}`。 +内置时间变量让查询跟随页面选择的时间范围与步长，不必把时间写死，写法为 `$__interval` 或 `${__interval}`。Prometheus 和 Loki 的区间查询都可以使用；Loki 的即时查询还可以使用其中两个。 | 变量 | 含义 | |------|-----------| | `$__interval` | 查询步长，如 `30s`，不小于 **最小 step** | | `$__rate_interval` | 步长加 15 秒，且不低于 60 秒，适合用于 `rate()` | | `$__range` | 时间窗口的长度，如 `3600s` | -| `$__auto` | Loki 区间查询中等于步长 | +| `$__auto` | Loki 区间查询中等于步长；Loki 即时查询中等于整个时间窗口的长度，如 `1h` | + +可用范围： | 查询 | 可用变量 | |------|------------------| | Prometheus 区间（**仅图表**） | `$__interval`、`$__rate_interval`、`$__range` | | Loki 区间 | `$__auto`、`$__interval`、`$__range` | -| Prometheus / Loki 即时查询 | 无 | +| Loki 即时 | `$__auto`、`$__range` | +| Prometheus 即时（**仅原始**） | 无 | -- 即时查询中使用这些变量会报错。 -- Prometheus 默认的 **图表 + 原始** 会同时执行区间查询和即时查询，因此其中的即时部分无法使用 `$__rate_interval`。需要使用时，请切换到 **仅图表**。 +- 写在不支持它的查询里会报错：Prometheus 的即时查询一个都不支持；Loki 的即时查询只接受 `$__auto` 与 `$__range`，`$__interval` 和 `$__rate_interval` 仍会报错。 +- Prometheus 默认的 **图表 + 原始** 会同时发起区间查询和即时查询两个请求。表达式里出现内置时间变量（`$__interval`、`${__auto}` 这类）时，工作台只执行区间查询，**原始** 面板不再发起即时查询，因此它不会有样本、停在“尚未运行”状态；表达式里没有内置时间变量时，两半照常都发。使用 `$__rate_interval` 不再需要手动切换到 **仅图表**。 - 这些变量与[仪表盘](/zh/monitors/dashboards/dashboards#内置时间变量)中的同名变量含义相同。工作台没有仪表盘变量，其他 `$` 文本会原样发给数据源。 ## AI 查询助手 diff --git a/zh/monitors/quickstart/quickstart.mdx b/zh/monitors/quickstart/quickstart.mdx index 8d32aad65..6c305922f 100644 --- a/zh/monitors/quickstart/quickstart.mdx +++ b/zh/monitors/quickstart/quickstart.mdx @@ -67,7 +67,7 @@ keywords: ["入门指南", "monitedge", "数据源", "告警规则", "快速开 告警规则可能会很多，Monitors 提供树形分组结构进行分类管理。每个告警规则都要属于某个分组，您可以先创建分组，再在分组下创建告警规则。 -创建 / 编辑告警规则的页面是一个单页表单，自上而下分为五个区块：**基础配置**、**数据源与查询**、**告警判定**、**检测频率 & 生效时间**、**事件配置**。 +创建 / 编辑告警规则的页面是一个单页表单，自上而下分为六个区块：**基础配置**、**数据源与查询**、**告警判定**、**检测频率 & 生效时间**、**事件配置**、**调查入口**。 ### 基础配置 @@ -204,6 +204,25 @@ keywords: ["入门指南", "monitedge", "数据源", "告警规则", "快速开 最大通知次数并不代表终端用户收到的消息提醒次数。因为 Monitors 产生的告警事件会投递到 On-call，可能会被聚合降噪，最终发送次数取决于 On-call 配置。 +### 调查入口 + +区块 6 用于配置**调查入口**：把每条告警直接接到一个仪表盘视图或一份查好的初始查询上，值班人员从告警一跳就能看到该看的图、该查的数据。 + +| 配置项 | 说明 | +|--------|------| +| **添加仪表盘入口** | 选择仪表盘并可定位到整个仪表盘、某个标签页、分组或图表，同时为该仪表盘的模板变量指定取值 | +| **添加查询入口** | 保存一份初始查询（数据源 + 查询类型 + 查询语句 + 查询参数），默认在告警事件自己的数据源上执行 | +| **调查用途** | 一句话说明这个入口帮助确认什么，可选 | +| **时间范围** | 「告警前 N 分钟，至告警后 M 分钟」，以告警事件时间为锚点，默认告警前 60 分钟、告警后 0 分钟 | + +最多 20 个入口，可以拖动调整顺序（顺序只影响展示）；点击入口右侧的眼睛图标可以按该规则的一条真实告警**预览跳转**。入口随规则保存生效，渲染成快照后随告警事件下发，因此改规则不会影响已经产生的告警。 + + +保存调查入口需要 monit-edge `v0.75.3` 或以上版本：保存时会检查该规则匹配到的数据源所在集群内所有活跃实例，只要有实例低于该版本，保存即被拒绝。 + + +字段含义、模板变量、校验限制与快照语义详见[调查入口](/zh/monitors/alert-rules/investigation-entries)。 + ## 查看效果 完成配置后，如果告警条件触发，告警规则前的状态会变成 `Triggered`。 diff --git a/zh/on-call/channel/create-edit.mdx b/zh/on-call/channel/create-edit.mdx index 332be2ef9..538cf1f29 100644 --- a/zh/on-call/channel/create-edit.mdx +++ b/zh/on-call/channel/create-edit.mdx @@ -34,7 +34,7 @@ keywords: ["协作空间", "创建管理", "业务隔离", "团队协作", "告 ## 创建空间 -进入 **协作空间** → **创建协作空间**，创建向导分三步完成，**第二步、第三步均可跳过**，后续在空间详情页补齐即可。 +进入 **协作空间** → **创建协作空间**，创建向导分四步完成，**第二步、第三步均可跳过**；第四步 **告警聚合** 不可跳过，但会按订阅版本预选一种聚合方式，可直接沿用。跳过的步骤后续在空间详情页补齐即可。 ### 第一步：协作空间信息 @@ -83,10 +83,35 @@ keywords: ["协作空间", "创建管理", "业务隔离", "团队协作", "告 勾选一个或多个要挂接到当前空间的告警集成插件（如 Zabbix、Prometheus、阿里云监控等），系统将为空间生成对应的 Webhook 地址。 +- **已选集成**：已勾选的集成显示在页面顶部区域；未选择时显示「选择后的集成将会出现在这里」 +- **可选集成**：下方列表支持用 **搜索集成** 输入框按名称过滤，过滤后没有匹配项时显示「未找到匹配的集成」，没有可选集成时显示「暂无可选集成」；可见范围为 **私有** 的集成不会出现在可选列表中 + 若点击 **跳过**，后续可在 **协作空间详情 → 配置 → 集成数据 → 专属集成** 中添加。详见 [接入告警](/zh/on-call/channel/integrate-data)。 +### 第四步：告警聚合 + +选择新空间「告警 → 故障」的合并方式，并调整默认配置。此步骤没有 **跳过** 按钮，保存空间时会把这里的选择一并写入新空间。 + +| 方式 | 说明 | 版本可用性 | +| :------- | :--------------------- | :--- | +| **智能聚合** | 根据标题、描述和标签内容的相似程度自动判断 | 专业版及以上 | +| **规则聚合** | 字段值相同的告警进入同一故障，结果明确、可预览 | 标准版及以上 | +| **不聚合** | 每条告警创建一个故障，不加入已有故障 | 所有版本 | + +向导按订阅版本预选第一种可用方式，并在该卡片右上角标记 **默认**：免费版预选 **不聚合**，标准版预选 **规则聚合**，专业版与私有化部署预选 **智能聚合**。不在订阅范围内的方式置灰不可选，悬停提示「当前订阅暂不支持该聚合方式」。预选的默认配置可以直接沿用，也可以在此调整： + +| 配置项 | 说明 | +| :--- | :--- | +| **聚合字段**（仅规则聚合） | 默认 `labels.check`，可多选 `labels.check`、`labels.service`、`labels.resource`、告警标题 | +| **聚合时间** | **持续到故障关闭**（默认）或 **固定 60 分钟** | +| **高级配置 → 严格聚合**（仅规则聚合） | 开启后空值标签视为不同项；默认关闭 | +| **高级配置 → 参与判断的信息**（仅智能聚合） | 参与相似度判断的字段；默认 `title`、`description`、`labels.service`、`labels.resource` | +| **高级配置 → 风暴提醒** | 开启后合入告警数达到阈值（默认 100）时记录告警风暴事件并通知；默认关闭 | + +选择完成后点击 **保存** 创建空间。各聚合方式的完整说明与创建后的调整入口见 [配置告警降噪](/zh/on-call/channel/noise-reduction#告警聚合)。 + - 第二步、第三步跳过后，仅会创建空间本身；分派策略与集成均可在空间详情页随时补充或调整。 + 第二步、第三步跳过后，仅会创建空间本身；分派策略与集成均可在空间详情页随时补充或调整。第四步的告警聚合配置会随空间一起保存。 ## 空间概览 @@ -164,7 +189,7 @@ keywords: ["协作空间", "创建管理", "业务隔离", "团队协作", "告 | 能力 | 导航路径 | 说明 | | :--- | :--- | :--- | | **事件聚合** | 降噪处理 → 事件聚合 | 控制相同 `alert_key` 的事件在聚合窗口内是否合入同一条告警 | -| **告警聚合** | 降噪处理 → 告警聚合 | 将同一主机、同一服务的相似告警合并为一条故障 | +| **告警聚合** | 降噪处理 → 告警聚合 | 将相似告警合并为一条故障，可选智能聚合、规则聚合或关闭聚合 | | **抖动检测** | 降噪处理 → 抖动检测 | 自动识别并屏蔽短时间内反复震荡的告警 | | **静默策略** | 降噪处理 → 静默策略 | 在预定的维护窗口或特定时间段，临时屏蔽特定条件下的告警通知 | | **抑制策略** | 降噪处理 → 抑制策略 | 利用告警之间的依赖关系减少冗余通知 | diff --git a/zh/on-call/channel/noise-reduction.mdx b/zh/on-call/channel/noise-reduction.mdx index 6b2c6ba45..e527739c7 100644 --- a/zh/on-call/channel/noise-reduction.mdx +++ b/zh/on-call/channel/noise-reduction.mdx @@ -4,7 +4,7 @@ description: "通过聚合、静默、抑制等策略减少告警噪音，提升 keywords: ["告警降噪", "告警聚合", "静默策略", "抑制策略", "噪音减少"] --- -**版本要求**：告警聚合、风暴预警和抑制策略功能需要 On-call 标准版及以上订阅，静默策略在所有版本中可用。[了解更多](https://flashcat.cloud/flashduty/price/) +**版本要求**：告警聚合的可选方式随订阅版本变化——**不聚合** 所有版本可用，**规则聚合** 需 On-call 标准版及以上，**智能聚合** 需 On-call 专业版（私有化部署默认可选）。风暴预警和抑制策略需要 On-call 标准版及以上订阅，静默策略在所有版本中可用。[了解更多](https://flashcat.cloud/flashduty/price/) 告警降噪是 Flashduty On-call 的核心能力之一，当告警风暴来袭时，您可能会收到数百条相似通知。降噪功能将这些告警聚合为一条故障，让您只需处理一次，而非被重复通知淹没。 @@ -85,6 +85,13 @@ src="https://download.flashcat.cloud/flashduty/video/alert-aggr.mp4" 事件聚合控制「事件 → 告警」的合并行为：当上游监控系统持续推送相同 `alert_key` 的事件时，是否将这些事件合入同一条已有告警，还是为每个事件创建独立的告警。 +事件进入已有告警需要同时满足以下四个条件，缺少任意一个都会创建新告警： + +- **同一协作空间**：事件与目标告警属于同一个协作空间 +- **alert_key 相同**：事件描述的是同一个告警生命周期 +- **目标告警仍活跃**：已恢复或已结束的告警不会继续接收事件 +- **仍在聚合窗口内**：超过窗口后，即使 `alert_key` 相同也会创建新告警 + 新建协作空间默认开启事件聚合，聚合窗口为 **24 小时**（1440 分钟）。 @@ -114,17 +121,22 @@ src="https://download.flashcat.cloud/flashduty/video/alert-aggr.mp4" 告警聚合将多条相似告警合并为一条故障，统一分派和通知。当告警风暴来袭时，您只需处理一条故障，而非数百条重复通知。 - 新建协作空间默认关闭告警聚合。未开启时，每条告警将创建一条独立故障。 + 新建协作空间的聚合方式由订阅版本推导，创建向导的 **告警聚合** 步骤会按版本预选，卡片右上角带 **默认** 标记，保存空间时即写入该配置：免费版默认 **不聚合**，标准版默认 **规则聚合**（默认聚合字段 `labels.check`），专业版与私有化部署默认 **智能聚合**（默认参与判断的字段为 `title`、`description`、`labels.service`、`labels.resource`）。默认配置下聚合窗口为 **持续到故障关闭**、风暴预警 **关闭**、严格聚合 **关闭**。您可以在向导里改选其他可用方式，也可以在空间创建后进入 **降噪处理 → 告警聚合** 调整，向导步骤见 [创建空间](/zh/on-call/channel/create-edit#第四步告警聚合)。 ### 聚合模式 -Flashduty On-call 提供两种聚合模式： +告警聚合页面提供三种互斥的方式，选择后需要保存才生效： + +| 方式 | 说明 | 版本可用性 | +| :------- | :--------------------- | :--- | +| **智能聚合** | 根据标题、描述和标签内容的相似程度自动判断。无需手动配置规则 | 专业版及以上（私有化部署默认可选） | +| **规则聚合** | 字段值相同的告警进入同一故障，结果明确、可预览 | 标准版及以上 | +| **不聚合** | 每条告警创建一个故障，不加入已有故障 | 所有版本 | + +不可用的方式在创建向导里显示为置灰不可选，悬停提示「当前订阅暂不支持该聚合方式」。方式对应 API 字段 `group_method` 的枚举值：`i`（智能聚合）、`p`（规则聚合）、`n`（不聚合），详见 [故障 Webhook](/zh/on-call/integration/webhooks/incident-webhook)。 -| 模式 | 适用场景 | 特点 | -| :------- | :------------- | :--------------------- | -| **智能聚合** | 快速上手，对聚合精度要求不高 | 基于机器学习分析语义相似度，无需手动配置规则 | -| **规则聚合** | 需要精确控制聚合逻辑 | 按指定维度（属性、标签）精确匹配 | +页面顶部的 **当前效果** 卡片会用一句话汇总当前生效的方式：不聚合时显示「不聚合 · 每条告警创建独立故障」，智能聚合时列出参与判断的字段，规则聚合时列出聚合字段（使用「不同告警使用不同规则」时改为按分支匹配），并附带聚合窗口、字段缺失时的处理规则和风暴提醒的开关状态。切换到不同方式时会先弹出确认框，确认后页面才切换到新方式的配置项，且仍需点击 **保存** 才真正生效。 ### 通用配置 @@ -142,7 +154,7 @@ Flashduty On-call 提供两种聚合模式： - 选择 **智能聚合** 模式 + 在页面顶部的 **聚合方式** 卡片中选择 **智能聚合**（标准版下该卡片置灰不可选，需专业版及以上） 选择参与相似度计算的字段。默认字段包括：标题（title）、描述（description）、labels.service、labels.resource。您可以根据业务需要添加或移除字段，最多支持选择 **10 个** 字段。点击 **重置** 可恢复默认配置。 @@ -156,23 +168,28 @@ Flashduty On-call 提供两种聚合模式： - 按指定维度精确匹配，仅当所有维度值完全相同时才聚合。 + 按指定维度精确匹配，仅当所有维度值完全相同时才聚合。页面上的 **聚合规则** 提供两张互斥的单选卡片，选择一套统一规则，或针对不同告警配置不同规则： - **统一控制**：空间内所有告警使用相同维度聚合。 + **所有告警使用同一规则**：空间内所有告警使用同一套 **聚合维度**（副标题为「什么相同才进入同一故障」），所有选中字段的值都相同时，告警进入同一故障。 - - ![统一控制配置](https://docs-cdn.flashcat.cloud/images/png/050d08ecb83427d7c56631f3dc19b553.png) + + ![所有告警使用同一规则配置](https://docs-cdn.flashcat.cloud/images/png/050d08ecb83427d7c56631f3dc19b553.png) - **细粒度控制**：按条件匹配不同聚合维度，针对不同类型的告警采用不同的聚合策略。您可以添加多个条件分支，每个分支包含匹配条件和对应的聚合维度： + **不同告警使用不同规则**：根据告警属性或标签，为不同告警配置不同规则。您可以添加多个条件分支，每个分支包含匹配条件和对应的聚合维度： - 系统从上到下依次匹配条件，命中第一个满足条件的分支后使用该分支的聚合维度 - 支持上下移动条件分支的优先级顺序 - - 底部设置 **默认维度** 作为后备，当告警未匹配到任何条件时，按照默认维度进行聚合 + - 底部 **未匹配任何规则时** 设置默认字段作为后备，说明为「按照下面的默认字段聚合；不设置则不聚合」——**留空时不会聚合**，未命中任何分支的告警各自创建新故障 - - ![细粒度控制配置](https://docs-cdn.flashcat.cloud/images/png/f8e69fbecb54fe52a71dc526134fc7d6.png) + + ![不同告警使用不同规则配置](https://docs-cdn.flashcat.cloud/images/png/f8e69fbecb54fe52a71dc526134fc7d6.png) + + 在 **聚合方式** 中选择 **不聚合** 后，页面只显示一张 **关闭告警聚合** 说明卡：保存后，每条新告警都会创建独立故障；已有故障和告警不会被修改。此方式下不显示聚合窗口、风暴预警、严格聚合等配置项。 + + 所有版本都可以选择 **不聚合**，这也是免费版唯一可用的方式。 + ### 配置限制 @@ -181,8 +198,8 @@ Flashduty On-call 提供两种聚合模式： | 聚合模式 | 限制项 | 上限 | 说明 | | :--- | :--- | :--- | :--- | -| **规则聚合** | 聚合维度（equals） | 每组 ≤ 5 个 | 统一控制与细粒度控制中单条规则可选的维度数量 | -| **规则聚合** | 细粒度分支（cases） | ≤ 100 条 | 细粒度控制下可配置的条件分支总数 | +| **规则聚合** | 聚合维度（equals） | 每组 ≤ 5 个 | 「所有告警使用同一规则」与「不同告警使用不同规则」中单条规则可选的维度数量 | +| **规则聚合** | 条件分支（cases） | ≤ 100 条 | 「不同告警使用不同规则」下可配置的条件分支总数 | | **智能聚合** | 参与相似度计算字段（i_keys） | ≤ 10 个 | 默认 4 个：`title`、`description`、`labels.service`、`labels.resource` | ### 聚合效果 @@ -226,7 +243,7 @@ Flashduty On-call 提供两种聚合模式： | **提醒后静默** | 标记抖动状态，首次提醒后不再通知 | - 新建协作空间默认开启抖动检测（**提醒后静默** 模式），默认参数为：观测窗口 60 分钟、状态变化 4 次、静默时长 120 分钟。 + 新建协作空间默认开启抖动检测，模式为 **仅提醒**（`mute_mins` 为 0）：识别到抖动后提醒一次，后续故障仍按原策略通知，默认参数为观测窗口 60 分钟、状态变化 4 次。**静默时长** 只在 **提醒后静默** 模式下生效，默认 120 分钟；把模式切换为 **提醒后静默** 时，系统会把静默时长按 120 分钟预填。 ### 可配置参数 @@ -235,10 +252,12 @@ Flashduty On-call 提供两种聚合模式： | :--- | :--- | :--- | :--- | | **状态变化次数** (max_changes) | 在观测窗口内，告警状态变化达到该次数即判定为抖动 | 4 次 | 2–100 | | **观测窗口** (in_mins) | 统计状态变化的时间窗口 | 60 分钟 | 1–1440 分钟 | -| **静默时长** (mute_mins) | 判定为抖动后，静默通知的持续时间（仅"提醒后静默"模式生效） | 120 分钟 | 30–1440 分钟 | +| **静默时长** (mute_mins) | 判定为抖动后，静默通知的持续时间。仅"提醒后静默"模式生效；"仅提醒"模式下该值为 0，不静默通知 | 120 分钟 | 30–1440 分钟 | - "相同故障"指具有相同 Alert Key 的故障，通常使用上游系统推送的告警 ID 作为唯一标识。 + **什么算同一故障**：Flashduty 取每个故障关联的 **首条告警** 的 `alert_key` 作为抖动检测标识；两个故障的该标识相同，才会在观测窗口内按同一问题统计。这里的判断 **不使用** 告警聚合页面配置的聚合维度。`alert_key` 由告警集成上报或按该集成的规则自动生成，不同集成的生成方式可能不同，不能在本页面修改。 + + 页面顶部的 **当前效果** 卡片会用一句话说明当前模式的效果（如「仅提醒 · 识别抖动后提醒一次」）。 ## 静默策略 diff --git a/zh/on-call/configuration/filter-conditions.mdx b/zh/on-call/configuration/filter-conditions.mdx index 437b8b1ab..7e05cb0b7 100644 --- a/zh/on-call/configuration/filter-conditions.mdx +++ b/zh/on-call/configuration/filter-conditions.mdx @@ -72,7 +72,7 @@ or ### 匹配方式 -目标值（value）都是字符串，系统按格式识别匹配方式：**正则**、**通配**、**IP 段**、**数值大小**，其余均为**精确**匹配。 +目标值（value）都是字符串，系统按格式识别匹配方式：**正则**、**通配**、**CIDR（IP 段）**、**数值大小**，其余均为**精确**匹配。条件编辑器会把可用方式直接列在输入框下方，其中第四种界面文案为 **CIDR 匹配**。 @@ -102,8 +102,8 @@ or - - 当 value 以 `cidr` 作为前缀，整个 value 将被识别为 **IP 段**。 + + 当 value 以 `cidr` 作为前缀，整个 value 将被识别为 **CIDR（IP 段）**。 **示例**： - `labels.host`：`cidr:10.0.0.206/24` — host 标签在 10.0.0.206/24 这个 IP 段内，即匹配 diff --git a/zh/on-call/configuration/schedule.mdx b/zh/on-call/configuration/schedule.mdx index 002893f94..2738d5ce4 100644 --- a/zh/on-call/configuration/schedule.mdx +++ b/zh/on-call/configuration/schedule.mdx @@ -51,7 +51,11 @@ Flashduty On-call 提供极具灵活性的值班编排能力，支持按天、 为了避免忘记值班或交接，系统提供两种通知时机： - **提前通知**：在轮换交接前 N 分钟（以 5 分钟为步长），同时通知"即将下班"和"即将接班"的人员 - - **定时通知**：在值班期间，每天固定时间（如上午 8:00）发送通知，提醒当前谁在值班。固定时间按值班表时区计算（与轮换、班次的墙钟口径一致）；当您的时区与值班表时区不一致时，时间输入框旁会以徽章标注值班表时区 + - **定时通知**：在值班期间，按所选周期在固定时刻发送通知，提醒当前谁在值班。周期可选 **每天** / **每周** / **每月**： + - **每天**：每天在所选时刻发送，默认 08:00 + - **每周**：多选星期几，在这些星期的所选时刻发送 + - **每月**：多选每月第几日（1–31），在这些日期的所选时刻发送。某个月没有所选日期（例如 2 月 30 日）时，该月不发送通知，选择框旁的提示会说明这一点 + - 固定时刻按**值班表时区**的墙上时间计算（与轮换、班次的口径一致）；当您的时区与值班表时区不一致时，时间输入框旁会以徽章标注值班表时区 启用任一通知时机后，您需要配置通知渠道： diff --git a/zh/on-call/incident/alert-management.mdx b/zh/on-call/incident/alert-management.mdx index 5d7ddace3..80cc462be 100644 --- a/zh/on-call/incident/alert-management.mdx +++ b/zh/on-call/incident/alert-management.mdx @@ -98,7 +98,7 @@ keywords: ["告警管理", "告警列表", "告警详情", "聚合视图", "告 | Tab | 说明 | | :--- | :--- | -| **告警概览** | 左侧展示告警描述、标签、**关联事件预览**（最多 5 条，可跳转到 *关联事件* Tab 查看全部）；右侧展示属性（协作空间、触发时间）、图片、告警来源、所属故障、Links | +| **告警概览** | 左侧展示告警描述、标签、**关联事件预览**（最多 5 条，可跳转到 *关联事件* Tab 查看全部）；右侧展示属性（协作空间、触发时间）、图片、告警来源、所属故障、Links。Monit 告警还会在 **属性** 之后多出一块 **排查入口**（详见下方 **排查入口**） | | **关联事件** | 展示该告警关联的所有原始事件列表 | 在告警详情地址后附加 `?tab=events`（如 `/alert/detail/{id}?tab=events`）可直达 **关联事件** 页签；切换页签时地址栏会同步更新。故障详情中的 **查看完整事件历史** 链接就是这样打开的。 @@ -108,6 +108,14 @@ keywords: ["告警管理", "告警列表", "告警详情", "聚合视图", "告 - **Monit 集成的告警**：显示产生该告警的规则名称，点击跳转到对应告警规则——实体树规则直接打开实体树的规则编辑视图，独立规则跳转到规则详情页；老数据缺少规则标签时，回退显示集成名称并跳转集成详情 - **其他集成的告警**：显示集成名称和类型标记（共享或专属），点击跳转到对应集成详情页 +### 排查入口 + +Monit 告警的右侧栏在 **属性** 之后多出一块 **排查入口**，与故障详情页右侧用的是同一块面板：列出产生该告警的告警规则在**告警触发那一刻**生成的排查入口快照（查询入口 / 仪表盘入口），默认展示前 **3** 条，其余收在 **还有 N 个** 后面；入口下方是 **关联告警规则** 与规则的 **查询语句**（主查询在触发时刻的值、关联查询的结果）。 + +其他集成（如 Zabbix、RUM）的告警不显示这一块；规则未配置排查入口、规则已删除、告警来自旧版 Edge、快照超过 8KB 时会改为显示对应的提示文案。 + +入口字段、异常徽标与失败文案的完整说明见[检索与查看故障 · 排查入口](/zh/on-call/incident/search-view-incident#排查入口)。 + ### 告警生命周期记录 告警从触发到关闭的整个过程会被系统完整记录，常见的记录类型如下： diff --git a/zh/on-call/incident/search-view-incident.mdx b/zh/on-call/incident/search-view-incident.mdx index a295a1374..5123d5373 100644 --- a/zh/on-call/incident/search-view-incident.mdx +++ b/zh/on-call/incident/search-view-incident.mdx @@ -137,7 +137,7 @@ keywords: ["故障检索", "故障列表", "聚合视图", "时间线", "故障 | 2 | 操作区域 | 各类高频操作按钮，在更多操作中，包含了自定义操作和低频操作按钮，其中创建作战室需要在 IM 集成中开启[作战室](/zh/on-call/advanced/war-room)。暂缓按钮支持自定义快捷时长预设，您可以在暂缓下拉菜单中进入设置，配置 3 个预设时长（支持小时或分钟），默认为 2 小时、4 小时和 12 小时 | | 3 | 详细信息 | 故障的描述、标签信息和 AI 总结（详见下方说明），标签内容支持拖拽排序和以 JSON 视图展示 | | 4 | Tab 区域 | 通过上方 Tab 页查看更详细的内容，详见下方 **详情 Tab** 说明 | -| 5 | 综合信息 | 集中展示故障的属性、关键时间节点、处理人员、关联链接、图片、自定义字段以及外部工单等辅助信息（详见下方 **综合信息面板**） | +| 5 | 综合信息 | 集中展示故障的属性、关键时间节点、处理人员、关联链接、图片、自定义字段以及外部工单等辅助信息，Monit 告警聚合出的故障还会多出一块 **排查入口**（详见下方 **综合信息面板**） | ### 标签快捷跳转 @@ -149,9 +149,15 @@ keywords: ["故障检索", "故障列表", "聚合视图", "时间线", "故障 | Monitors 告警规则 | `__alert_rule_id`（历史数据为 `rule_id`） | **查看规则**：打开产生告警的告警规则 | | Monitors 实体树 | `__entity_alert_rule_id` | **查看规则**：打开实体树中对应的告警规则 | -标签值无效或定位信息不完整时，只显示为普通文本。告警详情页的标签同样支持这些链接。 +如果标签值无效或定位信息不完整，只显示为普通文本。告警详情页的标签同样支持这些链接。 -如果标签携带告警当时的查询（如 PromQL 或日志表达式），标签右侧会显示 **去查询** 图标，点击会在新页签打开查询工作台，填好该查询，默认时间范围为触发前的时间窗口；有多条查询时可从列表中选择。 +链接类标签不会留在标签列表里，而是被提到列表上方的一行 **相关链接** 按钮条；标签值还会按格式识别为图片缩略图、ARN、时间和查询语句等形态。识别条件、按钮名映射与展示效果见[什么是故障 · 故障标签](/zh/on-call/incident/what-is-incident#相关链接与标签值展示)。 + +告警当时的查询不再挂在标签行上。要回到触发那一刻的查询，可以从这几处打开查询工作台： + +- **系统标签的悬停解读卡片**：`__alert_rule_queries`、`__alert_rule_values`、`__alert_rule_relate_queries` 等查询类系统标签，悬停即可看到查询内容与触发时刻的结果 +- **综合信息面板的排查入口**：右侧综合信息面板里的 **排查入口** 区块按入口类型给出该规则的查询（见下方 **排查入口** 一节） +- **关联告警 Tab 的「排查」浮层**：每一行告警都能用该条告警自己的标签生成入口 ### AI 总结 @@ -177,14 +183,41 @@ AI 总结仅适用于由告警自动触发的故障，手动创建的故障不 | 区块 | 说明 | | :--- | :--- | +| **处理人员** | 列出分派到该故障的所有处理人员（个人或值班人员）及其认领状态 | | **属性** | 协作空间、故障触发时间、告警数量等基础属性 | +| **排查入口** | 仅当故障由 Monit 告警聚合而成时出现，列出告警规则里配置的排查入口快照，默认展示 3 条；下方还会给出产生该故障的告警规则与其主查询 / 关联查询。详见下方 **排查入口** | | **图片** | 当故障关联的告警通过 API 上报了图片信息时展示。点击缩略图可预览，悬浮可查看图片的 Alt 描述和来源链接 | | **关键时间节点** | 以时间轴形式展示故障生命周期中的关键时间戳，包括 **触发时间**、**首次认领时间**、**关闭时间** 以及重新打开等节点，便于快速掌握故障进展 | -| **处理人员** | 列出分派到该故障的所有处理人员（个人或值班人员）及其认领状态 | | **关联链接** | 所属协作空间预配置的快捷链接（如监控大盘、Runbook、知识库），支持基于当前故障的标签或字段动态渲染参数，便于一键跳转到相关系统。关联链接的模板在协作空间设置中维护 | | **自定义字段** | 展示并允许编辑该故障的自定义字段取值，未设置的字段以 `-` 显示 | | **外部工单** | 如果您配置了 Jira、ServiceNow 或 ServiceDesk Plus 等工单集成，此处展示由该故障联动生成的外部工单，可直接点击跳转查看详情 | +### 排查入口 + +对由 Monit 告警聚合而成的故障，综合信息面板会在 **属性** 与 **图片** 之间多出一块 **排查入口**。它展示的不是实时查询结果，而是产生该故障的告警规则在**告警触发那一刻**渲染好的排查入口快照——面板只负责渲染快照，不会重新计算查询。 + +每条入口一行：最左边是入口类型图标（查询 / 仪表盘），然后是在规则里填写的**用途**与数据源（名称 + 类型图标）；规则没写用途时，查询入口直接显示查询语句，仪表盘入口显示仪表盘名称与定位路径（整个仪表盘或 `Tab › Panel`）。异常的入口在类型图标右上角带一个橙点。 + +- 悬停任意一条会弹出详情卡：完整的查询语句（可复制）、按名称列出的**变量**（由告警标签填入，`未解析` 的变量标红）、以及 **时间范围**（上一行是相对告警的前后时长，如「告警前 60 分钟 → 后 10 分钟」，下一行是绝对起止时间），底部是 **打开入口** 按钮，点击在新页签打开查询工作台或仪表盘对应视图 +- 标题旁的数字是快照里的入口条数；**N 个异常** 徽标统计其中渲染有问题的入口（查询渲染失败、仪表盘变量未解析、数据源或仪表盘已删除 / 无权限） +- 默认只显示前 **3** 条，其余收在 **还有 N 个** 后面，点击展开或收起 +- 入口列表下方是 **关联告警规则** 卡片（规则名称 + 数据源，点击跳转到规则）与 **查询语句**：主查询按 `A` / `B` 逐条给出**触发时刻的值**，悬停可看完整表达式并复制，无数据告警会在对应主查询上标注 **无数据**；关联查询给出**触发时刻的结果表格** + +规则尚未配置排查入口时，区块会提示「规则还没配排查入口」并提供 **去配置** 跳转。下面几种情况则改为显示一条失败文案： + +| 情况 | 提示与操作 | +| :--- | :--- | +| 规则的排查入口配置有误 | 「规则的排查入口配置有误，本次未生成」，附 **去修改规则** | +| 告警规则已被删除 | 「告警规则已被删除，无法生成排查入口」 | +| 告警来自旧版 Edge | 「这条告警来自旧版 Edge，升级到 v0.75.3 以上后，新告警会自动带上排查入口」 | +| 快照超过 8KB | 「排查入口内容超过 8KB，故障里放不下，可在监控的告警详情中查看」 | + +非 Monit 集成（如 Zabbix、RUM）聚合出的故障不会出现这块；较老的、没有携带排查入口快照的 Monit 告警只显示下方的 **关联告警规则** 与 **查询语句**。 + +在 **关联告警** Tab 中，每行告警标题右侧还有一个放大镜图标 **排查**，点击弹出「这条告警的排查入口」浮层：多告警故障里每条告警的标签不同，这个浮层用的是**该条告警自己的标签**，因此入口也可能与右侧面板不同。 + +告警详情页的右侧栏也内置同一块面板，见[告警管理 · 告警详情](/zh/on-call/incident/alert-management#排查入口)。 + ### 详情 Tab 故障详情页共包含 7 个 Tab，部分 Tab 会根据故障状态条件显示： diff --git a/zh/on-call/incident/what-is-incident.mdx b/zh/on-call/incident/what-is-incident.mdx index 66856d8d5..855bd8aae 100644 --- a/zh/on-call/incident/what-is-incident.mdx +++ b/zh/on-call/incident/what-is-incident.mdx @@ -64,17 +64,55 @@ API 字段中处理进度使用大写枚举值 `Triggered` / `Processing` / `Clo Flashduty On-call 提供了标签增强方案，用于自动化生成标签，前往[配置标签增强](/zh/on-call/integration/alert-integration/label-enhancement)了解更多。 -### 隐藏 Meta Label +### 系统标签 -故障/告警详情页的标签面板提供 **隐藏 Meta Label** / **展示 Meta Label** 切换按钮，用于过滤内部标签。内部标签即 Prometheus 风格的 Meta Label，名称以 `__` 开头并以 `__` 结尾，例如 `__instance__`、`__name__`。 +故障/告警详情页的标签面板把平台内部标签单独收在一个 **系统标签** 分区，标题右侧提供 **隐藏系统标签** / **显示系统标签** 切换按钮（带眼睛图标）。判定口径按告警来源区分： -- 仅当当前故障或告警的标签中存在 Meta Label 时，按钮才会出现 -- 切换状态后会同步保存为 **用户个人偏好**，跨会话、跨设备保持一致；移动端与 Web 端共用同一偏好 -- 隐藏 Meta Label 后，JSON 视图、格式化视图、复制操作和拖拽排序都基于过滤后的标签集合 +| 告警来源 | 判定为系统标签的标签 | +| :--- | :--- | +| Monit 告警（`monit.alert`） | 以 `__alert_rule_` 或 `__entity_alert_` 开头，例如 `__alert_rule_id`、`__entity_alert_promql`。`__name__` 这类不属于 Monit 的内部标签，仍留在普通标签里 | +| 其它来源 | 以 `__alert_rule_` / `__entity_alert_` / `__flashduty_` 开头，或名称以 `__` 开头并以 `__` 结尾，例如 `__instance__`、`__name__` | - - 接入 Prometheus、夜莺等会上报大量内部标签的集成时，建议默认隐藏 Meta Label，让标签面板更聚焦于业务维度。 - +- 仅当标签里确实存在系统标签时，切换按钮才会出现；按钮的悬停提示会说明当前告警来源的判定口径——Monit 告警显示「监控系统标签：以 `__alert_rule_` 或 `__entity_alert_` 开头」，其它来源显示「系统标签：以 `__` 开头的平台标签，如 `__alert_rule_id`、`__name__`」 +- **默认收起**。收起时列表底部是一条虚线按钮「N 个系统标签已收起（前几个 key…）」，点击展开为带分隔线的独立 **系统标签** 分区，再次点击标题旁的按钮收起 +- 切换状态保存为 **用户个人偏好**，跨会话、跨设备保持一致；移动端与 Web 端共用同一偏好 +- 标题旁的计数徽标是标签总数（含系统标签与相关链接），不是当前列表里显示的行数 +- 收起系统标签时，**JSON 视图** 和复制出来的 JSON 同步排除这些标签；拖拽排序只作用于普通标签，系统标签不参与排序 +- Monit 写入的系统标签带悬停解读卡片，把机器标签翻译成中文别名并给出跳转：`__alert_rule_id` → 告警规则，`__alert_rule_folder_*` → 规则所在目录，`__alert_rule_data_source_*` → 数据源，`__alert_rule_event_kind` → 触发 / 持续触发 / 恢复，`__alert_rule_values` 与 `__alert_rule_queries` → 各主查询触发时的值与查询语句，`__alert_rule_relate_*` → 关联查询及触发时刻的结果，`__alert_rule_investigation_context*` → 排查入口 + +### 相关链接与标签值展示 + +标签面板在列表上方提供一行 **相关链接** 按钮条，并为部分标签值做特殊渲染。 + +**相关链接**：值是 `http(s)://` 链接、且不是图片的标签不再作为普通标签参与排序，而是被提到列表上方，每个链接渲染为一个按钮。按钮名由标签 key 决定： + +| 标签 key | 按钮名 | +| :--- | :--- | +| `generatorURL`、`generator_url`、`detail_url`、`link`、`web_url`、`client_url`、`insight_url` | **查看来源**；告警所属集成有名称时显示 **在 X 中查看** | +| `runbook_url` | **Runbook** | +| `silenceURL` | **去静默** | +| `dashboardURL`、`dashboard_url` | **打开仪表盘** | +| `panelURL` | **打开面板** | +| `query_url` | **查看查询** | +| `log_url` | **查看日志** | +| `alert_url` | **查看告警** | +| `ruleURL`、`rule_url`、`alert_rule_url` | **查看规则** | +| `alert_history_url` | **告警历史** | +| 其它 key | `key · 域名` | + +按钮顺序先按上表的次序排列，未列到的 key 按字母序排在后面；悬停按钮可看到完整的 key 与 URL。图片链接（key 含 `image`，或链接以图片扩展名结尾）不属于相关链接，仍留在标签列表里。该提取只作用于普通标签，**系统标签** 分区里的链接标签保持原样。 + +**标签值的特殊渲染**：标签值按格式识别为以下几种形态，识别只看 key 名和值的格式，不依赖按集成维护的元数据。 + +| 形态 | 识别条件 | 展示效果 | +| :--- | :--- | :--- | +| 图片缩略图 | 值是 `http(s)` 链接，且 key 里含 `image`（如 Grafana 的 `imageURL`），或链接以 `.png` / `.jpg` / `.jpeg` / `.gif` / `.webp` / `.svg` 结尾 | 展示 160 × 90 的缩略图，点击在新页签打开原图；请求不带 referrer，滚动到可见位置才加载 | +| ARN | 值形如 `arn:partition:service:region:account:resource` | 主行显示资源段，后面跟 **服务** / **区域** 小标签 | +| 时间 | key 以 `_time` / `_at` / `timestamp` 结尾且值是 10 位（秒）或 13 位（毫秒）时间戳，且落在 2000–2100 年之间；或值本身是带时区的 ISO 8601 时间 | 按账户时区格式化为 `YYYY-MM-DD HH:mm:ss` 并附「x 前」相对时间，悬停可看原始值 | +| 时间（不带时区） | 值是 `YYYY-MM-DD HH:mm` 这类没有时区的墙钟串 | 原样显示，不做时区换算 | +| 查询语句 | key 以 `ql` / `promql` / `logql` / `query` / `expression` / `sql` 结尾（前面是分隔符或字符串开头，因此 `mysql`、`graphql` 不会被误判） | 等宽代码块展示，可整段复制 | + +图片与查询语句这类已有固定展示尺寸的形态不参与两行截断；其它超过两行的值会折叠，并给出 **查看全部** / **收起** 展开。 ## 故障生命周期 diff --git a/zh/on-call/integration/alert-integration/routing-rules.mdx b/zh/on-call/integration/alert-integration/routing-rules.mdx index 8e060fcd9..f08880bdf 100644 --- a/zh/on-call/integration/alert-integration/routing-rules.mdx +++ b/zh/on-call/integration/alert-integration/routing-rules.mdx @@ -23,11 +23,25 @@ keywords: ["路由规则", "告警路由", "分发策略", "协作空间", "分 | 配置项 | 说明 | | :--- | :--- | -| **匹配条件** | 按标签、属性等条件筛选告警，支持精确、通配符、正则匹配 | +| **匹配条件** | 按标签、属性等条件筛选告警，支持精确、通配、正则、CIDR（IP 段）、数值五种匹配方式 | | **路由模式** | 见下方详细说明 | | **流程控制** | **继续匹配**（默认）：命中后继续匹配后续规则；**停止匹配**：命中后不再匹配 | | **默认路由** | 后备规则，当没有任何规则实际投递到协作空间时生效 | +### 匹配方式 + +**匹配条件** 的取值都是字符串，系统按格式识别匹配方式。条件编辑器会在输入框下方直接列出当前支持的五种写法： + +| 方式 | 示例 | 识别规则 | +| :------- | :----------------------- | :-------------------------------- | +| **精确匹配** | `cpu.idle<10%` | 不符合其他任何格式时，字符串完全相等才算匹配 | +| **通配匹配** | `host * down` | 值包含 `*` 或 `?` 且没有 `/` 前后缀时按通配处理 | +| **正则匹配** | `/api-server-\d+/` | 值以 `/` 为前后缀时按 RE2 正则处理 | +| **CIDR 匹配** | `cidr:192.168.1.0/24` | 值以 `cidr:` 为前缀时按 IP 段匹配 | +| **数值匹配** | `num:gt:0.95` | 值以 `num:` + 比较符（`gt`/`ge`/`lt`/`le`）为前缀时按数值大小匹配 | + +完整的语法说明与示例见 [配置过滤条件](/zh/on-call/configuration/filter-conditions#匹配方式)。 + ### 路由模式 | 模式 | 说明 | 适用场景 | diff --git a/zh/platform/team-members.mdx b/zh/platform/team-members.mdx index ce6f1b2f4..43978073c 100644 --- a/zh/platform/team-members.mdx +++ b/zh/platform/team-members.mdx @@ -124,10 +124,10 @@ License 决定了成员是否可以查看和处理故障。在成员管理列表 您可以在成员列表的 License 列中执行以下操作： - **授予固定 License**：为成员分配一个固定 License，前提是当前仍有可用 License 额度 -- **取消 License**：释放成员的 License，释放后该成员将无法查看和处理故障 +- **取消 License**：释放成员的 License，释放后该成员将无法查看和处理故障。释放操作受[每个计费周期的释放次数上限](/zh/platform/pricing)约束：本周期额度用完后，持有固定或临时 License 的成员行上的**取消 License** 会置灰（悬停可见额度恢复时间），成员编辑弹窗中的**无**选项也不可选，需等到下一个计费周期才能再释放 -License 总数取决于您的订阅版本。当所有 License 已分配完毕时，需要先释放其他成员的 License 或升级订阅才能为新成员分配。 +License 总数取决于您的订阅版本。当所有 License 已分配完毕时，需要先释放其他成员的 License 或升级订阅才能为新成员分配；若本计费周期的释放次数已用完，则暂时只能升级订阅，释放要等到下一个计费周期。删除成员不受释放次数上限约束，其 License 会随之释放。 ### 成员详情 diff --git a/zh/rum/quickstart/app-management.mdx b/zh/rum/quickstart/app-management.mdx index 81c7dcae3..2ec14c5b3 100644 --- a/zh/rum/quickstart/app-management.mdx +++ b/zh/rum/quickstart/app-management.mdx @@ -350,7 +350,7 @@ Link 集成会从当前事件上下文中提取变量并替换到 URL 模板中 「远程配置」页签允许您在线调整采集与隐私参数，而无需改代码、重新发版。启用后，本页配置覆盖 SDK 初始化设置；停用后，各端恢复使用 SDK 初始化设置，数据采集不会停止。 -- 远程配置目前支持 **Browser**、**iOS**、**Android**、**Flutter** 与**微信小程序**类型应用，其他平台类型将随各端 SDK 发布逐步开放。 +- 远程配置目前支持 **Browser**、**iOS**、**Android**、**HarmonyOS**、**Flutter** 与**微信小程序**类型应用，其他平台类型将随各端 SDK 发布逐步开放。 - 「远程配置」页签对所有账户开放（SaaS 与私有化部署一致），无需联系支持团队开通；页签是否显示只取决于应用类型是否属于上一条列出的受支持平台。 @@ -360,15 +360,15 @@ Link 集成会从当前事件上下文中提取变量并替换到 URL 模板中 |------|------|------| | **会话采样率** | 0–100 整数（%） | 采集会话的比例。留空表示不下发该项，各端沿用 SDK 初始化时设置的值 | | **会话回放采样率** | 0–100 整数（%） | 录制会话回放的比例。留空时沿用 SDK 设置 | -| **异常会话补采**（`sessionOnError`） | 开 / 关 / 沿用 SDK 设置 | 对会话采样未抽中的会话，报错后补报最多最近一分钟的事件，并继续采集；仅支持 Web SDK 0.3.0 及以上 | +| **异常会话补采**（`sessionOnError`） | 开 / 关 / 沿用 SDK 设置 | 对会话采样未抽中的会话，报错后补报最多最近一分钟的事件，并继续采集；Web 应用需 Web SDK 0.3.0 及以上，HarmonyOS 应用需使用支持该开关的 HarmonyOS SDK | | **异常回放补采**（`sessionReplayOnError`） | 开 / 关 / 沿用 SDK 设置 | 对已采集但回放采样未抽中的会话，报错后补报缓存回放并继续录制；仅支持 Web SDK 0.3.0 及以上 | | **Trace 采样率** | 0–100 整数（%） | 在已采集的会话中再按此比例做一次会话级采样，决定哪些会话为符合条件请求注入 trace 头；同一会话内的结果一致。整体 Trace 覆盖率约为「会话采样率 × Trace 采样率」。留空时沿用 SDK 设置 | | **回放脱敏级别** | `mask` / `mask-user-input` / `allow` | 会话回放对页面内容的默认遮蔽程度：`mask` 遮蔽文本并隐藏输入值；`mask-user-input` 保留页面文本、仅隐藏用户输入；`allow` 按原样录制。放宽级别会开始录制此前未采集的内容，且已上传的回放无法事后补充脱敏，发布前系统会再次确认 | | **自定义配置项** | 键值对，类型支持字符串 / 数字 / 布尔值 / JSON | 随远程配置下发到客户端、由应用代码读取，平台不解析其内容。最多 5 个；键名最长 64 字节（按 UTF-8 计，非字符数），单个值最大 4 KB，JSON 值最多嵌套 3 层（对象、数组各计一层），全部自定义项合计最大 16 KB | -两个异常补采开关独立设置：**开**下发 `true`，**关**下发 `false`，**沿用 SDK 设置**不下发该项，由 `init()` 中对应参数决定（未设置时默认关闭）。Browser 应用需使用 Web SDK 0.3.0 及以上，并在初始化时开启 `remoteConfigurationEnabled: true`。关闭补采不影响普通采样已抽中的会话。补采范围、计费与限制见 [Web SDK 异常会话补采](/zh/rum/sdk/web/advanced-config#异常会话补采)。 +两个异常补采开关独立设置：**开**下发 `true`，**关**下发 `false`，**沿用 SDK 设置**不下发该项，由 `init()` 中对应参数决定（未设置时默认关闭）。Browser 应用需使用 Web SDK 0.3.0 及以上，并在初始化时开启 `remoteConfigurationEnabled: true`；HarmonyOS 应用使用同一个 `sessionOnError` 开关（初始化时调用 `.setRemoteConfigurationEnabled(true)`），没有回放补采开关。关闭补采不影响普通采样已抽中的会话。补采范围、计费与限制见 [Web SDK 异常会话补采](/zh/rum/sdk/web/advanced-config#异常会话补采)。 -iOS、Android、Flutter 与微信小程序应用同样展示「远程配置」页签，但这几端的 SDK 仅读取**会话采样率**与**自定义配置项**两项（均无 Session Replay，其余配置不下发也不生效）。各端 SDK 都需要在初始化时开启 `remoteConfigurationEnabled: true`（默认关闭，未开启的应用不会请求配置）；iOS 端需要 SDK 0.6.0 及以上，接入方式见 [iOS SDK 高级配置](/zh/rum/sdk/ios/advanced-config)；Android 端需要 SDK 0.7.0 及以上，接入方式见 [Android SDK 高级配置](/zh/rum/sdk/android/advanced-config)；Flutter 端需要 `flashcat_flutter_plugin` 0.2.0 及以上，接入方式见 [Flutter SDK 高级配置](/zh/rum/sdk/flutter/advanced-config)。 +iOS、Android、Flutter 与微信小程序应用同样展示「远程配置」页签，但这几端的 SDK 仅读取**会话采样率**与**自定义配置项**两项（均无 Session Replay，其余配置不下发也不生效）；HarmonyOS 应用除这两项外还会读取**异常会话补采**（同样没有 Session Replay，回放与 Trace 相关配置不下发也不生效）。各端 SDK 都需要在初始化时开启 `remoteConfigurationEnabled: true`（默认关闭，未开启的应用不会请求配置）；iOS 端需要 SDK 0.6.0 及以上，接入方式见 [iOS SDK 高级配置](/zh/rum/sdk/ios/advanced-config)；Android 端需要 SDK 0.7.0 及以上，接入方式见 [Android SDK 高级配置](/zh/rum/sdk/android/advanced-config)；HarmonyOS 端同样需要在初始化时开启远程配置，接入方式见 [HarmonyOS SDK 高级配置](/zh/rum/sdk/harmony/advanced-config#远程配置)；Flutter 端需要 `flashcat_flutter_plugin` 0.2.0 及以上，接入方式见 [Flutter SDK 高级配置](/zh/rum/sdk/flutter/advanced-config)。 自定义配置项会下发到客户端，可能被终端用户读取。请勿填写密钥、访问令牌或个人敏感信息。 diff --git a/zh/rum/sdk/harmony/advanced-config.mdx b/zh/rum/sdk/harmony/advanced-config.mdx index fb86b23d8..babcf7dd5 100644 --- a/zh/rum/sdk/harmony/advanced-config.mdx +++ b/zh/rum/sdk/harmony/advanced-config.mdx @@ -1,10 +1,10 @@ --- title: "HarmonyOS SDK 高级配置" -description: "配置 HarmonyOS RUM SDK 的采样、隐私同意、事件过滤、Trace、崩溃采集和符号上传" -keywords: ["RUM", "HarmonyOS SDK", "高级配置", "Trace", "Crash", "Sourcemap"] +description: "配置 HarmonyOS RUM SDK 的采样率与远程配置、隐私同意、事件过滤、Trace、崩溃采集和符号上传" +keywords: ["RUM", "HarmonyOS SDK", "高级配置", "远程配置", "Trace", "Crash", "Sourcemap"] --- -本文介绍 HarmonyOS SDK 的核心配置、RUM 配置、隐私控制、Trace 关联、崩溃采集和符号上传。所有配置均来自当前 ArkTS SDK 公开 API。 +本文介绍 HarmonyOS SDK 的核心配置、RUM 配置、远程配置、隐私控制、Trace 关联、崩溃采集和符号上传。所有配置均来自当前 ArkTS SDK 公开 API。 ## 核心配置 @@ -205,6 +205,51 @@ const rumConfig = new RumConfigurationBuilder('') 事件过滤函数运行在 SDK 写入路径上，应保持快速、同步且不抛异常。SDK 会兜底处理异常并保留原始事件，但复杂逻辑会增加端侧开销。 +## 远程配置 + +会话采样率可以在控制台 **应用管理 → 远程配置** 页签在线调整，无需改代码、重新发版。该功能默认关闭，需要在初始化时开启： + +```ts +import { FlashcatRum, RumConfigurationBuilder } from '@flashcatcloud/rum'; + +FlashcatRum.enable( + new RumConfigurationBuilder('') + .setSessionSampleRate(100) // 控制台未下发时使用的采样率 + .setRemoteConfigurationEnabled(true) // 允许控制台调整采样率与异常补采 + .build() +); +``` + +开启后的行为： + +- SDK 在启动时与每次新建会话时各请求一次配置，拿到的配置对**下一个新会话**生效，进行中的会话不受影响；请求不会阻塞会话创建。 +- 采样率**跨过 0**（由 0 调为非 0，或由非 0 调为 0）时当前会话会立即结束，由新配置重新抽样，紧急关停或重新开启不必等会话自然轮换；其余变化都等到下一个新会话。（协议预留的「立即生效」也会提前结束会话，但当前控制台版本尚不支持选择它。） +- 下发的值会持久化到本地，冷启动后的第一个会话即按上次下发的配置抽样；从未成功拿到过配置、或控制台停用了远程配置时，恢复使用初始化时的 `setSessionSampleRate`。 +- 请求失败、超时或响应无法识别时，沿用已生效的值，不会清空；SDK 约 5 秒后重试一次、再约 60 秒后重试一次（两次都带 ±20% 抖动），之后等到下一个新会话或下次启动才再请求。 +- HarmonyOS SDK 只读取**会话采样率**、**异常会话补采**（`sessionOnError`）与**自定义配置项**三项，其余配置项不生效。没有 Session Replay，回放与 Trace 相关的开关不会在 HarmonyOS 应用里出现。 +- 异常补采与初始化时的 `setSessionOnError` 是同一个开关：控制台下发的值覆盖初始化值，对之后抽样的会话生效；不识别该字段的 SDK 会忽略它，补采仍由初始化决定。 + +被异常补采保留的会话上报的会话采样率为 `0`，并带 `session.sampled_for_error: true` 标记；没有报错的候选会话不会上传、不产生费用。筛选方式见[数据查询语法指南](/zh/rum/explorer/data-query)中的 `session_sampled_for_error`。 + + +私有化部署时配置接口位于 RUM 上报地址旁的 `/api/v2/rum/config` 路径（如上报地址是 `https://host/api/v2/rum`，配置接口就是 `https://host/api/v2/rum/config`）。使用 `setCustomEndpoint()` 时，请确认网关放行了该路径。 + + +自定义配置项通过 `GlobalRumMonitor.get().getRemoteConfig()` 读取，返回已解析好的对象；未开启远程配置、控制台未设置该项，或尚未拿到配置时返回 `null`： + +```ts +import { GlobalRumMonitor } from '@flashcatcloud/rum'; + +const custom = GlobalRumMonitor.get().getRemoteConfig(); +const debugUsers = custom?.['debugUsers'] as string[] | undefined; +``` + + +自定义配置项会下发到客户端，任何持有 Client Token 的人都能读到。请勿在其中存放密钥、访问令牌或个人敏感信息。 + + +控制台侧的配置项、发布与生效方式见 [应用管理 · 远程配置](/zh/rum/quickstart/app-management#远程配置)。 + ## 全局属性和用户信息 全局属性会合并到后续事件的 `context` 对象中。 From 216c4cbbea520a39fb0bea425a572d4928faa932 Mon Sep 17 00:00:00 2001 From: "flashduty[bot]" Date: Wed, 14 Oct 2026 08:39:59 +0000 Subject: [PATCH 2/2] =?UTF-8?q?docs:=20doc-review=202026-10-14=20=E2=80=94?= =?UTF-8?q?=20scope=20the=20License-release=20cap=20to=20both=20license=20?= =?UTF-8?q?types;=20restore=20source-verified=20HarmonyOS=20SDK=20version?= =?UTF-8?q?=20gates?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - platform/pricing: the per-period release cap applies to releasing a fixed or a temporary License (enforced per account in fc-event logic/resource/usage.go), so move it out of the 临时 License tab into a type-agnostic Note. - rum: keep the HarmonyOS remote-config / sessionOnError version gates (0.6.0 / 0.7.0) — verified against fc-sdk-harmony tags harmony-sdk-v0.6.0 and harmony-sdk-v0.7.0. --- en/platform/pricing.mdx | 5 ++++- en/rum/quickstart/app-management.mdx | 6 +++--- en/rum/sdk/harmony/advanced-config.mdx | 6 +++--- zh/platform/pricing.mdx | 5 ++++- zh/rum/quickstart/app-management.mdx | 6 +++--- zh/rum/sdk/harmony/advanced-config.mdx | 6 +++--- 6 files changed, 20 insertions(+), 14 deletions(-) diff --git a/en/platform/pricing.mdx b/en/platform/pricing.mdx index 28b69a844..db92d30a2 100644 --- a/en/platform/pricing.mdx +++ b/en/platform/pricing.mdx @@ -162,12 +162,15 @@ This approach ensures comprehensive notification coverage while significantly re - **Permanently valid** within the purchase period - **Automatically released** at the end of each cycle - **Administrators** can grant temporary Licenses to members - - The number of License releases in each billing period is limited - Can be occupied through assignment or preemption when sufficient Licenses are available - Suitable for members who participate temporarily or use occasionally + +The number of License **releases** an account can perform within one billing period is limited, and releasing a **fixed** or a **temporary** License both count against the limit; once it is used up, you can release again only in the next billing period. **Deleting a member is not a release** and does not count against the limit; that member's License is released together with the member. + + #### Permissions for members without license diff --git a/en/rum/quickstart/app-management.mdx b/en/rum/quickstart/app-management.mdx index 561d631b0..35ff973b0 100644 --- a/en/rum/quickstart/app-management.mdx +++ b/en/rum/quickstart/app-management.mdx @@ -363,19 +363,19 @@ The **Remote Configuration** tab lets you adjust collection and privacy paramete |------|------|------| | **Session sample rate** | Integer 0–100 (%) | Percentage of sessions collected. Leave it empty to skip delivering this field; clients keep the value set at SDK initialization | | **Session replay sample rate** | Integer 0–100 (%) | Percentage of sessions recorded by Session Replay. If empty, the SDK setting applies | -| **On-error session capture** (`sessionOnError`) | On / Off / Use SDK setting | For sessions missed by session sampling, uploads up to the last minute of events on error and continues collection; Web applications require Web SDK 0.3.0 or later, HarmonyOS applications require a HarmonyOS SDK that supports the option | +| **On-error session capture** (`sessionOnError`) | On / Off / Use SDK setting | For sessions missed by session sampling, uploads up to the last minute of events on error and continues collection; Web applications require Web SDK 0.3.0 or later, HarmonyOS applications require HarmonyOS SDK 0.7.0 or later | | **On-error replay capture** (`sessionReplayOnError`) | On / Off / Use SDK setting | For collected sessions missed by replay sampling, uploads buffered replay on error and continues recording; requires Web SDK 0.3.0 or later | | **Trace sample rate** | Integer 0–100 (%) | A second session-level sampling pass within already-collected sessions, deciding which sessions inject trace headers into eligible requests; the outcome is consistent within one session. Overall trace coverage is roughly *session sample rate × trace sample rate*. If empty, the SDK setting applies | | **Replay privacy level** | `mask` / `mask-user-input` / `allow` | Default masking of page content in Session Replay: `mask` obscures text and hides input values; `mask-user-input` keeps page text and hides only what users typed; `allow` records the page as it is. Loosening the level starts collecting content that was not collected before, and replays already uploaded cannot be retroactively masked. The console asks you to confirm again before publishing | | **Custom configuration keys** | Key–value pairs typed as string / number / boolean / JSON | Delivered to clients together with the remote configuration and read by your application code; the platform does not interpret them. Up to 5 keys; each key name is at most 64 bytes (counted in UTF-8, not characters), each value at most 4 KB and nesting at most 3 levels (objects and arrays each count one level), and all custom entries together at most 16 KB | -The two on-error options are independent: **On** delivers `true`, **Off** delivers `false`, and **Use SDK setting** omits the field so the corresponding `init()` option applies (off if unset). Browser applications require Web SDK 0.3.0 or later with `remoteConfigurationEnabled: true` at initialization; HarmonyOS applications use the same `sessionOnError` option (with `.setRemoteConfigurationEnabled(true)` at initialization) and have no on-error replay option. Turning off on-error capture does not affect sessions selected by ordinary sampling. See [Web SDK on-error session capture](/en/rum/sdk/web/advanced-config#on-error-session-capture) for scope, billing, and limitations. +The two on-error options are independent: **On** delivers `true`, **Off** delivers `false`, and **Use SDK setting** omits the field so the corresponding `init()` option applies (off if unset). Browser applications require Web SDK 0.3.0 or later with `remoteConfigurationEnabled: true` at initialization; HarmonyOS applications use the same `sessionOnError` option (HarmonyOS SDK 0.7.0 or later, with `.setRemoteConfigurationEnabled(true)` at initialization) and have no on-error replay option. Turning off on-error capture does not affect sessions selected by ordinary sampling. See [Web SDK on-error session capture](/en/rum/sdk/web/advanced-config#on-error-session-capture) for scope, billing, and limitations. iOS, Android, Flutter, and WeChat Mini Program applications also show the **Remote Configuration** tab, but their SDKs read only the **session sample rate** and **custom configuration keys**; the HarmonyOS SDK reads those two plus **on-error session capture**. None of them has Session Replay, and the other values have no effect. Every SDK has to opt in with `remoteConfigurationEnabled: true` at initialization (off by default; an application that has not opted in never requests the configuration). Minimum versions: - iOS: SDK 0.6.0. See [iOS SDK Advanced Configuration](/en/rum/sdk/ios/advanced-config#remote-configuration). - Android: SDK 0.7.0. See [Android SDK Advanced Configuration](/en/rum/sdk/android/advanced-config#remote-configuration-adjust-the-sample-rate-from-the-console). -- HarmonyOS: enable remote configuration at initialization (see [HarmonyOS SDK Advanced Configuration](/en/rum/sdk/harmony/advanced-config#remote-configuration) for the SDK version requirements). +- HarmonyOS: SDK 0.6.0, or 0.7.0 for on-error session capture. See [HarmonyOS SDK Advanced Configuration](/en/rum/sdk/harmony/advanced-config#remote-configuration). - Flutter: `flashcat_flutter_plugin` 0.2.0. See [Flutter SDK Advanced Configuration](/en/rum/sdk/flutter/advanced-config#remote-configuration). diff --git a/en/rum/sdk/harmony/advanced-config.mdx b/en/rum/sdk/harmony/advanced-config.mdx index 9b1a24c49..27a167751 100644 --- a/en/rum/sdk/harmony/advanced-config.mdx +++ b/en/rum/sdk/harmony/advanced-config.mdx @@ -207,7 +207,7 @@ The event mapper runs on the SDK write path. Keep it fast, synchronous, and non- ## Remote configuration -The session sample rate can be adjusted online in the console under **Application Management → Remote Configuration**, with no code change and no new release. The feature is off by default and has to be enabled at initialization: +From HarmonyOS SDK 0.6.0, the session sample rate can be adjusted online in the console under **Application Management → Remote Configuration**, with no code change and no new release. The feature is off by default and has to be enabled at initialization: ```ts import { FlashcatRum, RumConfigurationBuilder } from '@flashcatcloud/rum'; @@ -226,8 +226,8 @@ Once enabled: - A sample rate **crossing zero** (from 0 to a non-zero rate, or the other way round) ends the current session immediately so the new rate redraws it — an emergency stop or restart does not have to wait for the session to rotate. Any other change waits for the next new session. (The protocol's reserved "immediate" activation also ends the session early, but the console cannot select it yet.) - Fetched values are persisted locally, so the first session after a cold start is drawn under what was last published. When nothing has ever been fetched, or the console switched remote configuration off, the value set at initialization with `setSessionSampleRate` applies. - A request that fails, times out or comes back unreadable keeps the values already in force; nothing is wiped. The SDK retries about 5 seconds later and once more about 60 seconds after that (both with ±20% jitter), then waits for the next session or the next launch. -- The HarmonyOS SDK reads only the **session sample rate**, **on-error session capture** (`sessionOnError`) and **custom configuration keys**; the other fields have no effect. There is no Session Replay, so the replay and Trace switches never appear for a HarmonyOS application. -- On-error capture is the same switch as `setSessionOnError` at initialization: a value published from the console overrides the init value for the sessions drawn afterwards. An SDK that does not recognise the field ignores it, and on-error capture stays whatever initialization set. +- The HarmonyOS SDK reads only the **session sample rate**, **on-error session capture** (`sessionOnError`, from SDK 0.7.0) and **custom configuration keys**; the other fields have no effect. There is no Session Replay, so the replay and Trace switches never appear for a HarmonyOS application. +- On-error capture is the same switch as `setSessionOnError` at initialization: a value published from the console overrides the init value for the sessions drawn afterwards. An SDK older than 0.7.0 ignores the field, and on-error capture stays whatever initialization set. Sessions kept by on-error capture report a session sample rate of `0` and carry `session.sampled_for_error: true`; candidate sessions that never report an error are not uploaded and are not billed. See `session_sampled_for_error` in [Data query syntax guide](/en/rum/explorer/data-query) for how to filter them. diff --git a/zh/platform/pricing.mdx b/zh/platform/pricing.mdx index d2a96d112..3a8cbecf6 100644 --- a/zh/platform/pricing.mdx +++ b/zh/platform/pricing.mdx @@ -162,12 +162,15 @@ Flashduty 的 License 模式将**故障处理能力**和**通知接收能力** - 在购买有效期内**长期有效** - 每个周期结束时**自动释放** - **管理者** 可以授予成员临时 License - - 每个计费周期内释放 License 的次数有上限 - 在有足够 License 时，可通过分配或抢占方式占用 - 适用于临时参与或偶尔使用的成员 + +一个账户在一个计费周期内可执行的 License **释放**次数有上限，释放**固定**和**临时** License 都计入该上限；额度用完后，要等到下一个计费周期才能再释放。**删除成员不算作释放**，不占用该额度，成员的 License 随成员一起释放。 + + #### 无 License 成员权限 diff --git a/zh/rum/quickstart/app-management.mdx b/zh/rum/quickstart/app-management.mdx index 2ec14c5b3..f1e9d2172 100644 --- a/zh/rum/quickstart/app-management.mdx +++ b/zh/rum/quickstart/app-management.mdx @@ -360,15 +360,15 @@ Link 集成会从当前事件上下文中提取变量并替换到 URL 模板中 |------|------|------| | **会话采样率** | 0–100 整数（%） | 采集会话的比例。留空表示不下发该项，各端沿用 SDK 初始化时设置的值 | | **会话回放采样率** | 0–100 整数（%） | 录制会话回放的比例。留空时沿用 SDK 设置 | -| **异常会话补采**（`sessionOnError`） | 开 / 关 / 沿用 SDK 设置 | 对会话采样未抽中的会话，报错后补报最多最近一分钟的事件，并继续采集；Web 应用需 Web SDK 0.3.0 及以上，HarmonyOS 应用需使用支持该开关的 HarmonyOS SDK | +| **异常会话补采**（`sessionOnError`） | 开 / 关 / 沿用 SDK 设置 | 对会话采样未抽中的会话，报错后补报最多最近一分钟的事件，并继续采集；Web 应用需 Web SDK 0.3.0 及以上，HarmonyOS 应用需 HarmonyOS SDK 0.7.0 及以上 | | **异常回放补采**（`sessionReplayOnError`） | 开 / 关 / 沿用 SDK 设置 | 对已采集但回放采样未抽中的会话，报错后补报缓存回放并继续录制；仅支持 Web SDK 0.3.0 及以上 | | **Trace 采样率** | 0–100 整数（%） | 在已采集的会话中再按此比例做一次会话级采样，决定哪些会话为符合条件请求注入 trace 头；同一会话内的结果一致。整体 Trace 覆盖率约为「会话采样率 × Trace 采样率」。留空时沿用 SDK 设置 | | **回放脱敏级别** | `mask` / `mask-user-input` / `allow` | 会话回放对页面内容的默认遮蔽程度：`mask` 遮蔽文本并隐藏输入值；`mask-user-input` 保留页面文本、仅隐藏用户输入；`allow` 按原样录制。放宽级别会开始录制此前未采集的内容，且已上传的回放无法事后补充脱敏，发布前系统会再次确认 | | **自定义配置项** | 键值对，类型支持字符串 / 数字 / 布尔值 / JSON | 随远程配置下发到客户端、由应用代码读取，平台不解析其内容。最多 5 个；键名最长 64 字节（按 UTF-8 计，非字符数），单个值最大 4 KB，JSON 值最多嵌套 3 层（对象、数组各计一层），全部自定义项合计最大 16 KB | -两个异常补采开关独立设置：**开**下发 `true`，**关**下发 `false`，**沿用 SDK 设置**不下发该项，由 `init()` 中对应参数决定（未设置时默认关闭）。Browser 应用需使用 Web SDK 0.3.0 及以上，并在初始化时开启 `remoteConfigurationEnabled: true`；HarmonyOS 应用使用同一个 `sessionOnError` 开关（初始化时调用 `.setRemoteConfigurationEnabled(true)`），没有回放补采开关。关闭补采不影响普通采样已抽中的会话。补采范围、计费与限制见 [Web SDK 异常会话补采](/zh/rum/sdk/web/advanced-config#异常会话补采)。 +两个异常补采开关独立设置：**开**下发 `true`，**关**下发 `false`，**沿用 SDK 设置**不下发该项，由 `init()` 中对应参数决定（未设置时默认关闭）。Browser 应用需使用 Web SDK 0.3.0 及以上，并在初始化时开启 `remoteConfigurationEnabled: true`；HarmonyOS 应用使用同一个 `sessionOnError` 开关（需 HarmonyOS SDK 0.7.0 及以上，初始化时调用 `.setRemoteConfigurationEnabled(true)`），没有回放补采开关。关闭补采不影响普通采样已抽中的会话。补采范围、计费与限制见 [Web SDK 异常会话补采](/zh/rum/sdk/web/advanced-config#异常会话补采)。 -iOS、Android、Flutter 与微信小程序应用同样展示「远程配置」页签，但这几端的 SDK 仅读取**会话采样率**与**自定义配置项**两项（均无 Session Replay，其余配置不下发也不生效）；HarmonyOS 应用除这两项外还会读取**异常会话补采**（同样没有 Session Replay，回放与 Trace 相关配置不下发也不生效）。各端 SDK 都需要在初始化时开启 `remoteConfigurationEnabled: true`（默认关闭，未开启的应用不会请求配置）；iOS 端需要 SDK 0.6.0 及以上，接入方式见 [iOS SDK 高级配置](/zh/rum/sdk/ios/advanced-config)；Android 端需要 SDK 0.7.0 及以上，接入方式见 [Android SDK 高级配置](/zh/rum/sdk/android/advanced-config)；HarmonyOS 端同样需要在初始化时开启远程配置，接入方式见 [HarmonyOS SDK 高级配置](/zh/rum/sdk/harmony/advanced-config#远程配置)；Flutter 端需要 `flashcat_flutter_plugin` 0.2.0 及以上，接入方式见 [Flutter SDK 高级配置](/zh/rum/sdk/flutter/advanced-config)。 +iOS、Android、Flutter 与微信小程序应用同样展示「远程配置」页签，但这几端的 SDK 仅读取**会话采样率**与**自定义配置项**两项（均无 Session Replay，其余配置不下发也不生效）；HarmonyOS 应用除这两项外还会读取**异常会话补采**（同样没有 Session Replay，回放与 Trace 相关配置不下发也不生效）。各端 SDK 都需要在初始化时开启 `remoteConfigurationEnabled: true`（默认关闭，未开启的应用不会请求配置）；iOS 端需要 SDK 0.6.0 及以上，接入方式见 [iOS SDK 高级配置](/zh/rum/sdk/ios/advanced-config)；Android 端需要 SDK 0.7.0 及以上，接入方式见 [Android SDK 高级配置](/zh/rum/sdk/android/advanced-config)；HarmonyOS 端需要 SDK 0.6.0 及以上（读取异常会话补采需要 0.7.0 及以上），接入方式见 [HarmonyOS SDK 高级配置](/zh/rum/sdk/harmony/advanced-config#远程配置)；Flutter 端需要 `flashcat_flutter_plugin` 0.2.0 及以上，接入方式见 [Flutter SDK 高级配置](/zh/rum/sdk/flutter/advanced-config)。 自定义配置项会下发到客户端，可能被终端用户读取。请勿填写密钥、访问令牌或个人敏感信息。 diff --git a/zh/rum/sdk/harmony/advanced-config.mdx b/zh/rum/sdk/harmony/advanced-config.mdx index babcf7dd5..0900a94f7 100644 --- a/zh/rum/sdk/harmony/advanced-config.mdx +++ b/zh/rum/sdk/harmony/advanced-config.mdx @@ -207,7 +207,7 @@ const rumConfig = new RumConfigurationBuilder('') ## 远程配置 -会话采样率可以在控制台 **应用管理 → 远程配置** 页签在线调整，无需改代码、重新发版。该功能默认关闭，需要在初始化时开启： +HarmonyOS SDK 0.6.0 起，会话采样率可以在控制台 **应用管理 → 远程配置** 页签在线调整，无需改代码、重新发版。该功能默认关闭，需要在初始化时开启： ```ts import { FlashcatRum, RumConfigurationBuilder } from '@flashcatcloud/rum'; @@ -226,8 +226,8 @@ FlashcatRum.enable( - 采样率**跨过 0**（由 0 调为非 0，或由非 0 调为 0）时当前会话会立即结束，由新配置重新抽样，紧急关停或重新开启不必等会话自然轮换；其余变化都等到下一个新会话。（协议预留的「立即生效」也会提前结束会话，但当前控制台版本尚不支持选择它。） - 下发的值会持久化到本地，冷启动后的第一个会话即按上次下发的配置抽样；从未成功拿到过配置、或控制台停用了远程配置时，恢复使用初始化时的 `setSessionSampleRate`。 - 请求失败、超时或响应无法识别时，沿用已生效的值，不会清空；SDK 约 5 秒后重试一次、再约 60 秒后重试一次（两次都带 ±20% 抖动），之后等到下一个新会话或下次启动才再请求。 -- HarmonyOS SDK 只读取**会话采样率**、**异常会话补采**（`sessionOnError`）与**自定义配置项**三项，其余配置项不生效。没有 Session Replay，回放与 Trace 相关的开关不会在 HarmonyOS 应用里出现。 -- 异常补采与初始化时的 `setSessionOnError` 是同一个开关：控制台下发的值覆盖初始化值，对之后抽样的会话生效；不识别该字段的 SDK 会忽略它，补采仍由初始化决定。 +- HarmonyOS SDK 只读取**会话采样率**、**异常会话补采**（`sessionOnError`，SDK 0.7.0 起）与**自定义配置项**三项，其余配置项不生效。没有 Session Replay，回放与 Trace 相关的开关不会在 HarmonyOS 应用里出现。 +- 异常补采与初始化时的 `setSessionOnError` 是同一个开关：控制台下发的值覆盖初始化值，对之后抽样的会话生效；早于 0.7.0 的 SDK 忽略该字段，补采仍由初始化决定。 被异常补采保留的会话上报的会话采样率为 `0`，并带 `session.sampled_for_error: true` 标记；没有报错的候选会话不会上传、不产生费用。筛选方式见[数据查询语法指南](/zh/rum/explorer/data-query)中的 `session_sampled_for_error`。