Alertmanager generates PD Alerts ignoring the severity value set in AM configuration

I have configured alertmanager to send events to pagerduty.
The configuration works (almost), when an alert is triggered in AM the event is generated in PD but the severity is not properly propagated.
I tried using templates taking the value from here .CommonLabels.severity, and even manually set a fixed value in the configuration.
In PD the event is always set to critical, and the urgency is set to low, this happens in both cases.

Here is the AM configuration:

apiVersion: monitoring.coreos.com/v1alpha1
kind: AlertmanagerConfig
metadata:
  name: istio-alert-manager-config
  namespace: istio-system
  labels:
    alertmanager: config
spec:
  route:
    groupBy: [application, alertname]
    groupWait: 15s
    groupInterval: 5m
    repeatInterval: 15h
    receiver: service-mesh-platform-istio
    routes:
    - continue: true
      matchers:
      - name: application
        value: istio
        regex: false
      - name: severity
        value: critical
        regex: false
      receiver: service-mesh-platform-istio
    - continue: true
      matchers:
      - name: application
        value: istio
        regex: false
      receiver: service-mesh-platform-istio
  receivers:
  - name: service-mesh-platform-istio
    pagerdutyConfigs:
    - sendResolved: true
      serviceKey:
        name: service-mesh-pagerduty-key
        key: serviceKey
      description: "Alert {{`{{ .CommonLabels.alertname }}`}}"
      severity: 'warning'
      details:
      - key: num_firing
        value: '{{ "{{ .Alerts.Firing | len }}" }}'
      - key: num_resolved
        value: '{{ "{{ .Alerts.Resolved | len }}" }}'
      - key: description
        value: '{{ "{{ range .Alerts -}}" }} - {{ "{{ .Annotations.summary }}" }}{{ "{{end}}" }}'
      - key: start_time
        value: '{{ "{{ range .Alerts -}}" }} - {{ "{{ .StartsAt }}" }}{{ "{{end}}" }}'
      - key: severity
        value: '{{ "{{ (index .Alerts 0).Labels.severity }}" }}'
      - key: severity_tmp
        value: '{{`{{if .CommonLabels.severity}}`}}{{`{{ .CommonLabels.severity | toLower }}`}}{{`{{ else }}`}}other{{`{{ end }}`}}'

Severity field was also set like this:
severity: '{{{{if .CommonLabels.severity}}}}{{{{ .CommonLabels.severity | toLower }}}}{{{{ else }}}}critical{{{{ end }}}}'

Thanks in advance

Are you sure that a PagerDuty supported severity value is being set by the params you are using? Any event rules/orchestrations in the path making changes along the way?

I’ve seen this one used in the past: severity: “{{ range.Alerts }}{{ .Labels.severity }}{{ end }}”

Some pointers here:

Hello, right now I’m setting the value manually to warning. Even though it is manually set, the severity is still presented as critical.

In my case your suggestion won’t work, because some alerts might contain multiple events. The result for severity: “{{ range.Alerts }}{{ .Labels.severity }}{{ end }}” will be:
severity: warningwarningwarning

That is why I used this 2 approaches in order to test it:

  • key: severity
    value: ‘{{ “{{ (index .Alerts 0).Labels.severity }}” }}’
  • key: severity_tmp
    value: ‘{{{{if .CommonLabels.severity}}}}{{{{ .CommonLabels.severity | toLower }}}}{{{{ else }}}}other{{{{ end }}}}’

and as you can see the values are populated correctly.

“severity”: “warning”,
“severity_tmp”: “warning”,

I’m putting the message that I can see in pagerduty as a reference (it is big, so, i’m removing some fields) at the end of the post.

Our configuration should not alter the payload between alertmanager and pagerduty, I’m going to try to get the message we are sending, I’m not sure if that is possible. Is there a way to see the payload that pagerduty is receiving from our configuration?

{
  "client": "Alertmanager",
  "client_url": "http://rancher-monitoring-alertmanager.cattle-monitoring-system:9093/#/alerts?receiver=istio-system-istio-alert-manager-config-service-mesh-platform-istio",
  "description": "Alert IstioProxyContainerMemoryUsageHighTESTING",
  "event_type": "trigger",
    "incident_key": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
    "service_key": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
  "details": {
    "description": "- Istio Proxy container (istio-proxy) Memory usage agent-6f7cdcd586-gbjcq.signadot % is above 25%.- .......",
    "firing": "Labels:
 - alertname = IstioProxyContainerMemoryUsageHighTESTING
 - application = istio
 - cluster = prometheus.mesh.staging
 - container = istio-proxy
 - namespace = istio-system
 - pod = agent-6f7cdcd586-gbjcq
 - prometheus = cattle-monitoring-system/rancher-monitoring-prometheus
 - severity = warning
Annotations:
 - graph_link = https://.....
 - runbook_url = https://.....
 - summary = Istio Proxy container (istio-proxy) Memory usage agent-6f7cdcd586-gbjcq.signadot % is above 25%.
Source: http://rancher-monitoring-prometheus.cattle-monitoring-system:9090/graph?g0.expr=......
Labels:
 - alertname = IstioProxyContainerMemoryUsageHighTESTING
 - application = istio
 - cluster = prometheus.mesh.staging
 - container = istio-proxy
 - namespace = istio-system
 - pod = ambassador-5f88b9d794-ds2lq
 - prometheus = cattle-monitoring-system/rancher-monitoring-prometheus
 - severity = warning
Annotations:
 - graph_link = https://........
 - runbook_url = https://........
.......
",
    "num_firing": "15",
    "num_resolved": "0",
    "resolved": "",
    "severity": "warning",
    "severity_tmp": "warning",
    "start_time": "- 2022-12-01 13:56:47.339 +0000 UTC- 2022-12-01 13:56:47.339 +0000 UTC- 2022-12-01 13:56:47.339 +0000.......
  }
}

Hello, any news on this question?

I changed the AM configuration in order to send the request somewhere I can analyze the JSON payload, here is the message, it seems to be ok, at least according to what I understand.

{
    "routing_key": "52d......",
    "dedup_key": "7dd......",
    "event_action": "trigger",
    "payload": {
        "summary": "Alert IstioProxyContainerMemoryUsageHighTESTING",
        "source": "Alertmanager",
        "severity": "warning",
        "custom_details": {
            "description": "- Istio Proxy container (istio-proxy) Memory usage istio-egressgateway-1-13-8-n2-7949d47d95-ccbnl.istio-system % is above 35%.- Istio Proxy container (istio-proxy) Memory usage istio-egressgateway-1-13-8-n2-7949d47d95-fl5s8.istio-system % is above 35%.- ..........",
            "firing": "Labels:\x5Cn - alertname = IstioProxyContainerMemoryUsageHighTESTING\x5Cn - cluster = prometheus.mesh.staging\x5Cn - container = istio-proxy\x5Cn - namespace = istio-system\x5Cn - pdtest = fernando-istio\x5Cn - pod = istio-egressgateway-1-13-8-n2-7949d47d95-ccbnl\x5Cn - prometheus = cattle-monitoring-system/rancher-monitoring-prometheus\x5Cn - severity = warning\x5CnAnnotations:\x5Cn - graph_link = https://grafana-v7.staging.platform.usw2.upwork/d/Kz5urrw7z/istio-custom-dashboard?orgId=1???\x5Cn - runbook_url = https://confluence.upworkcorp.com/display/PAI/Istio+OPs+handbook#IstioOPshandbook-IstioProxyContainerMemoryUsageHigh\x5Cn - summary = Istio Proxy container (istio-proxy) Memory usage istio-egressgateway-1-13-8-n2-7949d47d95-ccbnl.istio-system % is above 35%.\x5CnSource: http://rancher-monitoring-prometheus.cattle-monitoring-system:9090/graph?g0.expr=%28sum+by%28container%2C+pod%2C+namespace%29+%28container_memory_working_set_bytes%7Bcontainer%3D~%22istio-proxy%22%2Cnamespace%21%3D%22%22%2Cnamespace%21%3D%22kube-system%22%2Cnamespace%21%3D%22upwork-services%22%7D%29+%2F+%28sum+by%28container%2C+pod%2C+namespace%29+%28container_spec_memory_limit_bytes%7Bcontainer%21%3D%22POD%22%2Cnamespace%21%3D%22kube-sy.......",
            "num_firing": "8",
            "num_resolved": "0",
            "resolved": "",
            "severity": "warning",
            "severity_tmp2": "warning",
            "severity_tmp3": "- - - - - - - - ",
            "start_time": "- 2023-01-04 20:11:14.472 +0000 UTC- 2023-01-04 20:11:14.472 +0000 UTC- 2023-01-04 20:11:14.472 +0000 UTC- 2023-01-04 20:11:14.472 +0000 UTC- 2023-01-04 20:11:14.472 +0000 UTC- 2023-01-04 20:11:14.472 +0000 UTC- 2023-01-04 20:11:14.472 +0000 UTC- 2023-01-04 20:11:14.472 +0000 UTC"
        }
    },
    "client": "Alertmanager",
    "client_url": "http://....platform-istio-fernando"
}

Problem solved.
Alertmanager was sending notifications to PD using API V1, and the severity field is ignored.
We need to use integration key from Events API V2, in AM use routingKey instead of serviceKey.