Skip to main content

Alert Correlation (Planned)

Roadmap feature, not yet available

Alert correlation and incident grouping are not part of the current OpsWorker release. There is no incident entity, and OpsWorker does not group related alerts together: each incoming alert spawns its own investigation. This page describes the direction we plan to take. For the noise controls that work today (per-cluster alert rule filtering and basic duplicate detection), see Noise Reduction.

Overview​

When a single underlying issue causes multiple alerts (a pod crash that cascades into service and ingress errors), the ideal experience is one consolidated incident instead of several separate investigations. OpsWorker does not do this today. The goal of the planned correlation feature is to recognize when multiple alerts share a root cause and present them as a single incident.

What Happens Today​

  • Each alert that passes your alert rules is recorded and, if eligible, triggers its own investigation.
  • Identical duplicate alerts are suppressed by basic deduplication (same fingerprint, same start second). See Noise Reduction.
  • There is no cross-alert grouping, no incident view, and no time-window correlation.

What We Plan to Build​

The following describes intended direction and is subject to change.

Topology-Based Correlation​

During investigation, OpsWorker already discovers the dependency chain for an alerting resource. We plan to use that topology to connect alerts that fire for resources in the same chain:

graph TD
    A["Alert: Pod CrashLoopBackOff"] --> RC[Root Cause]
    B["Alert: Service 503 errors"] --> RC
    C["Alert: Ingress timeout"] --> RC
    RC["Deployment misconfiguration<br/>(single root cause)"]

A pod crash causes service endpoint loss, which causes ingress errors. The aim is to treat three alerts as one incident with a single root cause.

Timeline Correlation​

We also plan to consider alerts that fire within a similar timeframe for related resources as potentially linked, so the investigation can focus on a common root cause rather than each symptom independently.

Next Steps​