curl --request POST \
--url 'https://api.flashcat.cloud/enrichment/preview?app_key=' \
--header 'Content-Type: application/json' \
--data '
{
"integration_id": 6113996590131,
"rules": [
{
"kind": "extraction",
"if": [
{
"key": "labels.env",
"oper": "IN",
"vals": [
"prod"
]
}
],
"settings": {
"source_field": "labels.host",
"result_label": "service_name",
"pattern": "^(?P<result>[a-z0-9-]+)-\\d+$",
"override": false
}
}
],
"event": {
"title": "CPU usage 94% on checkout-7",
"description": "CPU usage above 90% for 5 minutes.",
"event_status": "Critical",
"labels": {
"env": "prod",
"host": "checkout-7",
"check": "cpu"
}
}
}
'import requests
url = "https://api.flashcat.cloud/enrichment/preview?app_key="
payload = {
"integration_id": 6113996590131,
"rules": [
{
"kind": "extraction",
"if": [
{
"key": "labels.env",
"oper": "IN",
"vals": ["prod"]
}
],
"settings": {
"source_field": "labels.host",
"result_label": "service_name",
"pattern": "^(?P<result>[a-z0-9-]+)-\d+$",
"override": False
}
}
],
"event": {
"title": "CPU usage 94% on checkout-7",
"description": "CPU usage above 90% for 5 minutes.",
"event_status": "Critical",
"labels": {
"env": "prod",
"host": "checkout-7",
"check": "cpu"
}
}
}
headers = {"Content-Type": "application/json"}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({
integration_id: 6113996590131,
rules: [
{
kind: 'extraction',
if: [{key: 'labels.env', oper: 'IN', vals: ['prod']}],
settings: {
source_field: 'labels.host',
result_label: 'service_name',
pattern: '^(?P<result>[a-z0-9-]+)-\d+$',
override: false
}
}
],
event: {
title: 'CPU usage 94% on checkout-7',
description: 'CPU usage above 90% for 5 minutes.',
event_status: 'Critical',
labels: {env: 'prod', host: 'checkout-7', check: 'cpu'}
}
})
};
fetch('https://api.flashcat.cloud/enrichment/preview?app_key=', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.flashcat.cloud/enrichment/preview?app_key=",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'integration_id' => 6113996590131,
'rules' => [
[
'kind' => 'extraction',
'if' => [
[
'key' => 'labels.env',
'oper' => 'IN',
'vals' => [
'prod'
]
]
],
'settings' => [
'source_field' => 'labels.host',
'result_label' => 'service_name',
'pattern' => '^(?P<result>[a-z0-9-]+)-\\d+$',
'override' => false
]
]
],
'event' => [
'title' => 'CPU usage 94% on checkout-7',
'description' => 'CPU usage above 90% for 5 minutes.',
'event_status' => 'Critical',
'labels' => [
'env' => 'prod',
'host' => 'checkout-7',
'check' => 'cpu'
]
]
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.flashcat.cloud/enrichment/preview?app_key="
payload := strings.NewReader("{\n \"integration_id\": 6113996590131,\n \"rules\": [\n {\n \"kind\": \"extraction\",\n \"if\": [\n {\n \"key\": \"labels.env\",\n \"oper\": \"IN\",\n \"vals\": [\n \"prod\"\n ]\n }\n ],\n \"settings\": {\n \"source_field\": \"labels.host\",\n \"result_label\": \"service_name\",\n \"pattern\": \"^(?P<result>[a-z0-9-]+)-\\\\d+$\",\n \"override\": false\n }\n }\n ],\n \"event\": {\n \"title\": \"CPU usage 94% on checkout-7\",\n \"description\": \"CPU usage above 90% for 5 minutes.\",\n \"event_status\": \"Critical\",\n \"labels\": {\n \"env\": \"prod\",\n \"host\": \"checkout-7\",\n \"check\": \"cpu\"\n }\n }\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.flashcat.cloud/enrichment/preview?app_key=")
.header("Content-Type", "application/json")
.body("{\n \"integration_id\": 6113996590131,\n \"rules\": [\n {\n \"kind\": \"extraction\",\n \"if\": [\n {\n \"key\": \"labels.env\",\n \"oper\": \"IN\",\n \"vals\": [\n \"prod\"\n ]\n }\n ],\n \"settings\": {\n \"source_field\": \"labels.host\",\n \"result_label\": \"service_name\",\n \"pattern\": \"^(?P<result>[a-z0-9-]+)-\\\\d+$\",\n \"override\": false\n }\n }\n ],\n \"event\": {\n \"title\": \"CPU usage 94% on checkout-7\",\n \"description\": \"CPU usage above 90% for 5 minutes.\",\n \"event_status\": \"Critical\",\n \"labels\": {\n \"env\": \"prod\",\n \"host\": \"checkout-7\",\n \"check\": \"cpu\"\n }\n }\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.flashcat.cloud/enrichment/preview?app_key=")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n \"integration_id\": 6113996590131,\n \"rules\": [\n {\n \"kind\": \"extraction\",\n \"if\": [\n {\n \"key\": \"labels.env\",\n \"oper\": \"IN\",\n \"vals\": [\n \"prod\"\n ]\n }\n ],\n \"settings\": {\n \"source_field\": \"labels.host\",\n \"result_label\": \"service_name\",\n \"pattern\": \"^(?P<result>[a-z0-9-]+)-\\\\d+$\",\n \"override\": false\n }\n }\n ],\n \"event\": {\n \"title\": \"CPU usage 94% on checkout-7\",\n \"description\": \"CPU usage above 90% for 5 minutes.\",\n \"event_status\": \"Critical\",\n \"labels\": {\n \"env\": \"prod\",\n \"host\": \"checkout-7\",\n \"check\": \"cpu\"\n }\n }\n}"
response = http.request(request)
puts response.read_body{
"request_id": "01HK8XQE3Z7JM2NTFQ5YJ8P9R4",
"data": {
"before": {
"title": "CPU usage 94% on checkout-7",
"labels": {
"check": "cpu",
"env": "prod",
"host": "checkout-7"
}
},
"after": {
"title": "CPU usage 94% on checkout-7",
"labels": {
"check": "cpu",
"env": "prod",
"host": "checkout-7",
"service_name": "checkout"
}
},
"steps": [
{
"index": 0,
"kind": "extraction",
"matched": true,
"skipped_reason": "",
"detail": "checkout",
"added": {
"service_name": "checkout"
},
"removed": null,
"changed": null,
"mapping_row": null
}
]
}
}{
"request_id": "01HK8XQE3Z7JM2NTFQ5YJ8P9R4",
"error": {
"code": "InvalidParameter",
"message": "The specified parameter is not valid."
}
}{
"request_id": "01HK8XQE3Z7JM2NTFQ5YJ8P9R4",
"error": {
"code": "Unauthorized",
"message": "You are unauthorized."
}
}{
"request_id": "01HK8XQE3Z7JM2NTFQ5YJ8P9R4",
"error": {
"code": "AccessDenied",
"message": "Access Denied."
}
}{
"request_id": "01HK8XQE3Z7JM2NTFQ5YJ8P9R4",
"error": {
"code": "RequestTooFrequently",
"message": "Request too frequently."
}
}{
"request_id": "01HK8XQE3Z7JM2NTFQ5YJ8P9R4",
"error": {
"code": "InternalError",
"message": "We encountered an internal error, and it has been reported. Please try again later."
}
}Preview enrichment rule results
Run unsaved enrichment rules over one event, the way ingestion would.
curl --request POST \
--url 'https://api.flashcat.cloud/enrichment/preview?app_key=' \
--header 'Content-Type: application/json' \
--data '
{
"integration_id": 6113996590131,
"rules": [
{
"kind": "extraction",
"if": [
{
"key": "labels.env",
"oper": "IN",
"vals": [
"prod"
]
}
],
"settings": {
"source_field": "labels.host",
"result_label": "service_name",
"pattern": "^(?P<result>[a-z0-9-]+)-\\d+$",
"override": false
}
}
],
"event": {
"title": "CPU usage 94% on checkout-7",
"description": "CPU usage above 90% for 5 minutes.",
"event_status": "Critical",
"labels": {
"env": "prod",
"host": "checkout-7",
"check": "cpu"
}
}
}
'import requests
url = "https://api.flashcat.cloud/enrichment/preview?app_key="
payload = {
"integration_id": 6113996590131,
"rules": [
{
"kind": "extraction",
"if": [
{
"key": "labels.env",
"oper": "IN",
"vals": ["prod"]
}
],
"settings": {
"source_field": "labels.host",
"result_label": "service_name",
"pattern": "^(?P<result>[a-z0-9-]+)-\d+$",
"override": False
}
}
],
"event": {
"title": "CPU usage 94% on checkout-7",
"description": "CPU usage above 90% for 5 minutes.",
"event_status": "Critical",
"labels": {
"env": "prod",
"host": "checkout-7",
"check": "cpu"
}
}
}
headers = {"Content-Type": "application/json"}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({
integration_id: 6113996590131,
rules: [
{
kind: 'extraction',
if: [{key: 'labels.env', oper: 'IN', vals: ['prod']}],
settings: {
source_field: 'labels.host',
result_label: 'service_name',
pattern: '^(?P<result>[a-z0-9-]+)-\d+$',
override: false
}
}
],
event: {
title: 'CPU usage 94% on checkout-7',
description: 'CPU usage above 90% for 5 minutes.',
event_status: 'Critical',
labels: {env: 'prod', host: 'checkout-7', check: 'cpu'}
}
})
};
fetch('https://api.flashcat.cloud/enrichment/preview?app_key=', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.flashcat.cloud/enrichment/preview?app_key=",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'integration_id' => 6113996590131,
'rules' => [
[
'kind' => 'extraction',
'if' => [
[
'key' => 'labels.env',
'oper' => 'IN',
'vals' => [
'prod'
]
]
],
'settings' => [
'source_field' => 'labels.host',
'result_label' => 'service_name',
'pattern' => '^(?P<result>[a-z0-9-]+)-\\d+$',
'override' => false
]
]
],
'event' => [
'title' => 'CPU usage 94% on checkout-7',
'description' => 'CPU usage above 90% for 5 minutes.',
'event_status' => 'Critical',
'labels' => [
'env' => 'prod',
'host' => 'checkout-7',
'check' => 'cpu'
]
]
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.flashcat.cloud/enrichment/preview?app_key="
payload := strings.NewReader("{\n \"integration_id\": 6113996590131,\n \"rules\": [\n {\n \"kind\": \"extraction\",\n \"if\": [\n {\n \"key\": \"labels.env\",\n \"oper\": \"IN\",\n \"vals\": [\n \"prod\"\n ]\n }\n ],\n \"settings\": {\n \"source_field\": \"labels.host\",\n \"result_label\": \"service_name\",\n \"pattern\": \"^(?P<result>[a-z0-9-]+)-\\\\d+$\",\n \"override\": false\n }\n }\n ],\n \"event\": {\n \"title\": \"CPU usage 94% on checkout-7\",\n \"description\": \"CPU usage above 90% for 5 minutes.\",\n \"event_status\": \"Critical\",\n \"labels\": {\n \"env\": \"prod\",\n \"host\": \"checkout-7\",\n \"check\": \"cpu\"\n }\n }\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.flashcat.cloud/enrichment/preview?app_key=")
.header("Content-Type", "application/json")
.body("{\n \"integration_id\": 6113996590131,\n \"rules\": [\n {\n \"kind\": \"extraction\",\n \"if\": [\n {\n \"key\": \"labels.env\",\n \"oper\": \"IN\",\n \"vals\": [\n \"prod\"\n ]\n }\n ],\n \"settings\": {\n \"source_field\": \"labels.host\",\n \"result_label\": \"service_name\",\n \"pattern\": \"^(?P<result>[a-z0-9-]+)-\\\\d+$\",\n \"override\": false\n }\n }\n ],\n \"event\": {\n \"title\": \"CPU usage 94% on checkout-7\",\n \"description\": \"CPU usage above 90% for 5 minutes.\",\n \"event_status\": \"Critical\",\n \"labels\": {\n \"env\": \"prod\",\n \"host\": \"checkout-7\",\n \"check\": \"cpu\"\n }\n }\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.flashcat.cloud/enrichment/preview?app_key=")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n \"integration_id\": 6113996590131,\n \"rules\": [\n {\n \"kind\": \"extraction\",\n \"if\": [\n {\n \"key\": \"labels.env\",\n \"oper\": \"IN\",\n \"vals\": [\n \"prod\"\n ]\n }\n ],\n \"settings\": {\n \"source_field\": \"labels.host\",\n \"result_label\": \"service_name\",\n \"pattern\": \"^(?P<result>[a-z0-9-]+)-\\\\d+$\",\n \"override\": false\n }\n }\n ],\n \"event\": {\n \"title\": \"CPU usage 94% on checkout-7\",\n \"description\": \"CPU usage above 90% for 5 minutes.\",\n \"event_status\": \"Critical\",\n \"labels\": {\n \"env\": \"prod\",\n \"host\": \"checkout-7\",\n \"check\": \"cpu\"\n }\n }\n}"
response = http.request(request)
puts response.read_body{
"request_id": "01HK8XQE3Z7JM2NTFQ5YJ8P9R4",
"data": {
"before": {
"title": "CPU usage 94% on checkout-7",
"labels": {
"check": "cpu",
"env": "prod",
"host": "checkout-7"
}
},
"after": {
"title": "CPU usage 94% on checkout-7",
"labels": {
"check": "cpu",
"env": "prod",
"host": "checkout-7",
"service_name": "checkout"
}
},
"steps": [
{
"index": 0,
"kind": "extraction",
"matched": true,
"skipped_reason": "",
"detail": "checkout",
"added": {
"service_name": "checkout"
},
"removed": null,
"changed": null,
"mapping_row": null
}
]
}
}{
"request_id": "01HK8XQE3Z7JM2NTFQ5YJ8P9R4",
"error": {
"code": "InvalidParameter",
"message": "The specified parameter is not valid."
}
}{
"request_id": "01HK8XQE3Z7JM2NTFQ5YJ8P9R4",
"error": {
"code": "Unauthorized",
"message": "You are unauthorized."
}
}{
"request_id": "01HK8XQE3Z7JM2NTFQ5YJ8P9R4",
"error": {
"code": "AccessDenied",
"message": "Access Denied."
}
}{
"request_id": "01HK8XQE3Z7JM2NTFQ5YJ8P9R4",
"error": {
"code": "RequestTooFrequently",
"message": "Request too frequently."
}
}{
"request_id": "01HK8XQE3Z7JM2NTFQ5YJ8P9R4",
"error": {
"code": "InternalError",
"message": "We encountered an internal error, and it has been reported. Please try again later."
}
}Restrictions
| Aspect | Value |
|---|---|
| Rate limits | 1,000 requests/minute; 50 requests/second per account |
| Permissions | Channels Manage (on-call) or Integrations Read (on-call) or Integrations Manage (on-call) |
Usage
- Nothing is saved and no alert or event is created.
integration_idmust be an integration of the account, and the caller must be allowed to read it.- A
mappingrule withmapping_type=apicalls the account’s mapping API with its stored headers, so the request also needs permission to edit the integration; without it the call fails. beforeis the event as it arrived,afteris the event after the rules;stepsexplains every rule — whether its conditions matched, why it was skipped, and which labels it added, removed or rewrote.- A firing event is rendered the way ingestion does after enrichment, so
[TPL]labels, title and description inafterare the final ones. ifkeys must come from the alert or change event vocabulary (title,description,labels.<name>, …); other keys returnInvalidParameter.
Authorizations
APP Key created in the Flashduty console under My → APP Key. Send it as the app_key query parameter or in the Fd-App-Key request header. Its effective access is the intersection of the key's permission scope and the creator's current role permissions. Keep it secret.
Body
Request body of POST /enrichment/preview.
Integration whose context the preview runs in. The rules you send are not saved.
x >= 1The event to run the rules over.
Show child attributes
Show child attributes
Enrichment rules to try, in order. At most 50. The integration's stored rules are not used.
50Show child attributes
Show child attributes
Response
Success
Success response envelope. On every 2xx response, request_id identifies the call (also mirrored in the Flashcat-Request-Id header) and data holds the endpoint-specific payload. Failure responses use a different shape — see ErrorResponse.
Was this page helpful?