Skip to main content
An OpenObserve webhook destination has no fixed request body: the body is the template you save. This integration defines one JSON template. Paste it into OpenObserve, and when an alert fires OpenObserve fills the variables in and posts the result to Flashduty. Each OpenObserve alert, identified by organization, stream type, stream, and alert name, maps to one Flashduty alert.

In Flashduty On-call

You can get the integration push URL in either of the following ways.

Use a dedicated integration

  1. In the Flashduty console, select Channel and open a channel
  2. Select Configuration → Integrations → Private integration, then click Add integration
  3. Select OpenObserve, then click Save
  4. Open the generated integration card and copy the Push URL

Use a shared integration

  1. In the Flashduty console, go to Integration Center → Alert Events
  2. Select OpenObserve and enter an integration name
  3. Configure the default route and select a channel. You can add more rules under Routing after creation
  4. Click Save and copy the generated Push URL

Configure OpenObserve

You need permission to manage alert templates and destinations.
1

Create a webhook template in OpenObserve

Where: OpenObserve › Management › Templates › Add Template (in OpenObserve 1.1 and later, templates are on the Destination Templates tab of the Reliability page)
The template must contain org_name, stream_name, and alert_name; Flashduty rejects a request that lacks any of them. You can remove the other fields. Save the template.
2

Create a webhook destination in OpenObserve

Where: OpenObserve › Management › Alert Destinations › Add Destination › Webhook (in OpenObserve 1.1 and later, destinations are on the Notification Destinations tab of the Reliability page)Click Save.
3

Use the destination in an OpenObserve alert and enable recovery notifications

Where: OpenObserve › Alerts (shown as Reliability from OpenObserve 1.1) › Create or edit an alert
4

Trigger an alert in OpenObserve and confirm

Where: OpenObserve › AlertsSave the alert and wait for its condition to be met, or trigger it once manually from the alert list. Then go back to Flashduty: the integration shows a Latest event time, which means the setup works. A manual trigger has empty alert_level and episode_id, so Flashduty opens it as Warning with no recovery request; for a real alert with recovery notifications on, the alert closes automatically when it recovers.

Alert key

Flashduty computes the Alert Key from org_name, stream_type, stream_name, and alert_name, so the trigger, repeated triggers, and recovery of one OpenObserve alert share an Alert Key. Changes to the level, result count, threshold, trigger time, or episode_id do not change it; an empty stream_type counts as an empty value. A request without org_name, stream_name, or alert_name is rejected. Renaming an OpenObserve alert, stream, or organization produces a new Alert Key.

Status and severity

An alert_status of resolved recovers the alert; any other value triggers it. Before OpenObserve 1.1, {alert_status}, {alert_level}, and {episode_id} are not substituted and arrive as the literal template text. Flashduty treats them as empty, so the alert triggers as Warning.

Recovery

Flashduty receives a recovery request, and closes the alert automatically, only with OpenObserve 1.1 or later and recovery notifications enabled on the alert. Otherwise every firing is an independent one-shot notification with no recovery request. For these alerts, set auto-close after timeout on the Flashduty integration or channel with a suitable duration, or the alert stays active.

Labels

The template does not contain {rows}, so Flashduty does not receive the log rows the query returned.

Troubleshooting

  • Flashduty returns an invalid-parameter error: Check that the URL is complete and includes integration_key, that the template contains org_name, stream_name, and alert_name, and that the template is valid JSON
  • The alert does not recover: Check that OpenObserve is 1.1 or later and that the alert has recovery notifications enabled; otherwise configure auto-close after timeout
  • The request fails when the alert name contains quotes or line breaks: OpenObserve fills variable values into the template as plain text, so a double quote or line break in the alert name can make the JSON invalid. Avoid these characters in alert names
  • The destination has no test button: OpenObserve’s webhook destination has no test send. You can fire the alert once from the alert list with ⋮ → Trigger: that delivery has an empty alert_level and episode_id, so Flashduty opens a Warning alert with no recovery request; close it manually or rely on auto-close
For more variables, see OpenObserve alert templates.