Skip to main content

​
Where are filter conditions used?

Filter conditions apply to the following scenarios:

​
How to configure filter conditions?

​
Rule design

A filter consists of one or more condition groups:
  • Conditions within a group: AND relationship—each condition must match for the group to match
  • Between groups: OR relationship—any group matching means overall match
Within each condition, there’s a field, operator (oper), and target values:
  • Match (IN): Target can have multiple values; if any value satisfies the condition, that condition matches
  • Not Match (NOTIN): Target can have multiple values; if all values don’t satisfy the condition, that condition matches
Flashduty supports only these two operators: match (IN) and not match (NOTIN). There are no separate equal, regex, or contains operators. The specific matching semantics are determined by the target-value format described below.

​
Available fields

Filter condition keys fall into two categories:
The difference between data_source_id (Integration) and integration_id (Integration Source (First Alert)):
  • data_source_id matches the integration that an alert itself comes from, used in scenarios that filter alerts by integration, such as subscription/exclusion rules
  • integration_id matches the integration that produced the incident’s first alert, used in the escalation rule’s incident filter
Both take integration instance IDs as values; in the UI you pick integrations from a multi-select dropdown.
Historically, alert_severity (alert severity) and incident_severity (incident severity) were used as two separate fields. They are now unified as severity. When loading legacy rules, the system automatically migrates both keys to severity — you don’t need to edit anything. Save the rule to persist the new key.
Filter Condition Example As shown above, we have two condition groups, each with two conditions, and conditions have multiple match values. The expression is:

​
Matching methods

Target values are always strings; the format decides the matching method: regex, wildcard, CIDR (IP range), or numeric comparison, and anything else is an exact match. The condition editor lists the available methods directly under the input; the fourth one is labelled CIDR Matching in the UI.
When a value string has / as prefix and suffix, Flashduty treats the entire value as regex.Example:
  • labels.check: /outage/ — matches when check label contains “outage”
Flashduty uses RE2 regex specification platform-wide. Some Perl syntax may not match. You can use AI Chatbot to generate expressions and verify at RE2 Playground.

​
FAQ

Flashduty On-call receives large volumes of data. To ensure system stability, the system only searches the most recent 500 alert events from the past 24 hours for label deduplication. Therefore, extracted labels may change dynamically, or no labels may be extracted if there’s no new data in the past 24 hours.In this case, you can manually enter labels.
Flashduty uses RE2 regex specification platform-wide. Some Perl syntax may not match. You can use AI Chatbot to generate expressions and verify at RE2 Playground.