Skip to main content
Use the HTTP Notification of a Logpoint (Guardsix) alert rule to send rule triggers to Flashduty On-call. Each alert rule maps to one Flashduty alert. Logpoint sends a notification only when the rule triggers and sends nothing when it clears, so alerts do not recover automatically. Turn on the auto-resolve timeout in the channel; see Alerts do not recover.

In Flashduty On-call

Create either a dedicated or shared Logpoint alert integration and copy its complete Push URL.

Configure Logpoint

The Logpoint HTTP Notification has no fixed payload; the body comes from the Jinja template you enter. Flashduty parses only the template below.
1

Open the notification settings of a Logpoint alert rule

Where: Logpoint › Settings › Knowledge Base › Alert Rules › the Setup Notification icon in the Actions columnFind the alert rule to notify on and click the Setup Notification icon in the Actions column. You can also select several rules and choose Setup Notifications of Selected Alert Rules from the MORE drop-down.
2

Configure HTTP Notification

Where: Logpoint › Settings › Knowledge Base › Alert Rules › Setup Notification › HTTP Notification › Notify via HTTPLogpoint’s HTTP Notification has no fixed payload; the Body is a Jinja template you write. Flashduty parses only the template below. Split the push URL {integration_url} into two fields: the domain part before ? goes in Base URL, and the part after ? goes in Query String.Then click Finish.
Keep alertrule_id; Flashduty rejects requests without it. Logpoint substitutes placeholders as plain text, so a double quote in a rule name or another value breaks the JSON. Remove the affected field or avoid double quotes in rule names.
Logpoint sends no recovery notification after a trigger and has no recovery template to configure; see Alerts do not recover for how alerts close.
3

Trigger the alert rule and confirm

Where: Logpoint › Settings › Knowledge Base › Alert RulesTrigger the alert rule (or wait for it to match) and confirm Flashduty receives an alert titled with the rule name and the integration shows a Latest event time.

Alert key

Flashduty uses alertrule_id ({{alertrule_id}}) as the Alert Key. The Logpoint documentation defines it as the ID of the alert. When the same rule triggers again it merges into the alert that is still open. incident_id changes on every trigger, so it is kept only as a label. Changes to the rule name, risk level or number of matching logs do not change the Alert Key.

Status and severity

Flashduty maps severity from risk_level ({{risk_level}}): The Logpoint documentation does not list every risk_level value; its examples use medium and high, and critical and low are inferred from the risk options in the rule editor.

Alerts do not recover

Logpoint sends no recovery notification. In the channel that receives this integration, turn on the auto-resolve timeout. 24 hours is a reasonable start; adjust it to how quickly your team handles alerts.

Troubleshooting

  • Logpoint sends no request: confirm Notification Trigger is Automatic and the rule is enabled and actually matching
  • Flashduty returns a parameter error: confirm the Body is valid JSON and keeps alertrule_id; double quotes in a log source or rule name break the JSON
  • The alert title is Logpoint alert <id>: alert_name is empty or was not rendered; check the placeholder spelling in the template
  • The alert never closes: this is expected; turn on the auto-resolve timeout
See Logpoint Reserved Jinja Placeholders and Alert Notifications for more placeholders.