Coralogix alert integration

Use a Coralogix Notification Center Generic HTTPS connector to send alerts to Flashduty On-call. Coralogix identifies an alert notification by its groupingKey, and Flashduty uses it as the Alert Key: the trigger, repeat notifications, and recovery of the same alert keep updating one Flashduty alert.

Configure Coralogix

These steps require Notification Center admin permissions (create connectors, presets, and routers, and edit alert definition labels).

Create a Generic HTTPS connector

In the left navigation, hover over Integrations, select Notification Center, and open the Connectors tab
Under Add new connector, click + next to Generic HTTPS and name the connector Flashduty
Paste the complete Flashduty integration Push URL into URL, keep the other fields at their defaults, and save the connector

Send test notification on the connector sends an empty JSON object {}. Flashduty returns success and creates no alert.

Create an alert preset

Open the Presets tab, switch to Alerts, and under Add new alert preset click + next to Generic HTTPS
Paste the following JSON into Body and save the preset

{
  "grouping_key": {{ alert.groupingKey | json_encode }},
  "status": {{ alert.status | json_encode }},
  "priority": {{ alert.highestPriority | default(value = alertDef.priority) | json_encode }},
  "alert_name": {{ alertDef.name | json_encode }},
  "alert_description": {{ alertDef.description | json_encode }},
  "alert_definition_id": {{ alertDef.id | default(value = "") | json_encode }},
  "alert_type": {{ alertDef.type | default(value = "") | json_encode }},
  "alert_url": {{ alert.alertDataUrl | default(value = "") | json_encode }},
  "team_name": {{ _context.system.name | default(value = "") | json_encode }},
  "entity_labels": {% if alertDef.entityLabels %}{{ alertDef.entityLabels | json_encode }}{% else %}{}{% endif %},
  "groups": [{% if alert.groups %}{% for g in alert.groups %}{"priority": {{ g.priority | default(value = "") | json_encode }}, "key_values": {% if g.keyValues %}{{ g.keyValues | json_encode }}{% else %}{}{% endif %}}{% if not loop.last %},{% endif %}{% endfor %}{% endif %}]
}

Keep grouping_key and status. Flashduty rejects requests without grouping_key because it cannot match the recovery to the original alert. status accepts only Triggered and Resolved.

Create a router and add an alert rule

Open the Routers tab and create a router with a routing label, for example Team set to payments. Routing label keys can only be Environment, Team, or Service
After saving, open the router’s Alerts tab (it shows Cases by default) and click New rule. Notify for all trigger types is on by default, so both trigger and recovery notifications are sent. Leave the condition empty to match all alerts
Select the Flashduty connector and the alert preset you created as the destination

Use an Alerts rule, not a Cases rule. Flashduty handles alert grouping and incident management itself, and this integration parses alert notifications only.

Configure the alert definition

Edit or create an alert definition. In the Response step, set the notification target to Alerts (not Cases) and Notification Method to Route via Labels
Add a routing label that matches the router, for example Team set to payments, which renders as routing.team: payments
Keep Send a notification when resolved selected (it is selected by default). Otherwise, Coralogix does not send recovery notifications
If the alert uses Group by, select Separate cases under Case settings so that each combination is notified separately and becomes a separate Flashduty alert. The default Combined case puts all combinations into one notification

Verify the lifecycle

Let the alert actually trigger and confirm that Flashduty receives an active alert. Then let the condition return to normal and confirm that the original alert recovers. For a logs threshold alert with a 5-minute window, the trigger notification arrives about 3 minutes after the logs are written, and the recovery notification about 6 minutes after the logs stop.Send test notification on the preset renders the preset with sample data and creates an Info alert named [Test Alert] General Example in Flashduty. This alert never receives a recovery notification, so close it manually in Flashduty.

Alert Key

Flashduty uses alert.groupingKey as the Alert Key. Coralogix defines groupingKey as the deduplication key in its alert notification schema, and its official Opsgenie and Jira Service Management setups use groupingKey to close the matching alert on Resolved. With Separate cases, each Group by combination is notified separately with its own groupingKey, so each one is a separate Flashduty alert. With Combined case, one notification covers every matching combination, so Flashduty creates one alert and lists each combination’s priority and values in the description, one per line. Changes to the title, description, priority, or group values do not change the Alert Key.

Status and severity

Flashduty uses status to tell triggers from recoveries, and priority (alert.highestPriority, or the alert definition priority when empty) to set the severity.

Coralogix `priority`	Flashduty severity
`P1`	Critical
`P2`	Critical
`P3`	Warning
`P4`	Info
`P5`	Info
Empty or any other value	Warning

When status is Resolved, Flashduty recovers the original alert and keeps its last severity. An empty or any other status is rejected.

Labels

Label	Source
`check`	Alert definition name
`grouping_key`	`alert.groupingKey`
`priority`	Alert priority
`alert_definition_id`, `alert_type`	Alert definition ID and type
`alert_url`	Link to the alert in Coralogix
`team_name`	Coralogix team name
Alert definition labels	`alertDef.entityLabels`. Characters such as `.` and `-` in keys become `_`, so `routing.team` becomes `routing_team`
Group values	Each key in `alert.groups[0].keyValues`, only when the notification has a single combination

An alert can have at most 50 labels. Requests that exceed this limit are rejected.

Troubleshooting

Coralogix reports a delivery failure: Confirm that the connector URL is the complete push URL and includes integration_key
Flashduty returns a parameter error: Confirm that the preset Body matches the template above, renders valid JSON, and that grouping_key and status are not empty
Alerts do not recover: Confirm that Send a notification when resolved is selected on the alert definition and that the routing rule has Notify for all trigger types on or includes Resolved. For alerts created with Terraform or the API, also confirm that notifyOn is not triggered_only. Resolving an alert manually in Coralogix does not send a notification
Several combinations merge into one alert: The alert definition’s Case settings is Combined case. Switch it to Separate cases
Using a legacy outbound webhook: This integration parses the body rendered by a Notification Center preset. Legacy outbound webhook templates with $ placeholders do not work. Coralogix recommends Notification Center over legacy webhooks

For more information, see the Coralogix documentation: Alerts as a notification source type, Generic HTTPS connector, and Routing rules.

Quick Start

Product Comparison

Channels

Incident Management

Post-Mortem

Status Page

Analytics

Integration Settings

Configuration

Advanced

Integrations

Best Practices

Coralogix alert integration

In Flashduty On-call

Use a dedicated integration

Use a shared integration

Configure Coralogix

Alert Key

Status and severity

Labels

Troubleshooting

​In Flashduty On-call

​Use a dedicated integration

​Use a shared integration

​Configure Coralogix

​Alert Key

​Status and severity

​Labels

​Troubleshooting

In Flashduty On-call

Use a dedicated integration

Use a shared integration

Configure Coralogix

Alert Key

Status and severity

Labels

Troubleshooting