OpenSearch alert integration

Use the triggers of OpenSearch Alerting monitors to send notifications from per query and per cluster metrics monitors to Flashduty On-call. OpenSearch has no fixed webhook payload; the content is set by the Mustache message template in the trigger’s action. This page provides a template, and Flashduty parses exactly that template. Each trigger of each monitor maps to one Flashduty alert: while the trigger condition holds, the monitor sends a notification on every run, and these notifications merge into the same alert. OpenSearch sends no recovery notification when the condition clears, so the channel needs auto-close turned on.

Configure OpenSearch

Create a custom webhook notification channel in OpenSearch Dashboards

Where: OpenSearch Dashboards › Management › Notifications › Channels › Create channel

Field	Value
Name (required)	Channel name
Channel type (required)	Custom webhook
Define endpoints by (required)	Webhook URL
Webhook URL (required)	`{integration_url}`, which must include `integration_key`
Method (required)	`POST`
Webhook headers (required)	Add `Content-Type: application/json`

Click Create.If the cluster sets opensearch.notifications.core.http.host_deny_list, make sure api.flashcat.cloud is not in it.

Add an action to the monitor trigger

Where: OpenSearch Dashboards › OpenSearch Plugins › Alerting › Monitors › Create monitor › Triggers › Add actionThe Alerting and Notifications plugins must be installed (OpenSearch ships with both), and you need permission to create notification channels and monitors. Create or edit a Per query monitor or Per cluster metrics monitor, then add a trigger and an action under Triggers:

Field	Value
Trigger name (required)	Trigger name
Severity level (required)	1 (highest) to 5 (lowest); the mapping is below
Trigger condition (required)	As needed
Notification channel (required)	The channel you just created
Message (required)	Paste the whole template below, without changing the quotation marks or field names
Action throttling (optional)	Limits how often notifications are sent

{
  "monitor_id": "{{ctx.monitor._id}}",
  "monitor_name": "{{ctx.monitor.name}}",
  "trigger_id": "{{ctx.trigger.id}}",
  "trigger_name": "{{ctx.trigger.name}}",
  "severity": "{{ctx.trigger.severity}}",
  "period_start": "{{ctx.periodStart}}",
  "period_end": "{{ctx.periodEnd}}",
  "hit_count": "{{ctx.results.0.hits.total.value}}",
  "error": "{{ctx.error}}"
}

Save the monitor.hit_count is the number of documents the query of a per query monitor matched. A per cluster metrics monitor has no such value and sends an empty string, which does not affect the alert. Per bucket, per document, and composite monitors expose different notification variables from this template and are not supported.Action throttling limits how often notifications are sent. No notification is sent while throttled, and the alert still closes on the auto-close timeout set below.

Turn on auto-close in Flashduty

Where: Flashduty console › Channels › Configuration › Settings › AdvancedTriggers of per query and per cluster metrics monitors run their actions only while the condition holds, and OpenSearch sends nothing once it clears, so these monitor types have no recovery setting. On the channel that receives these alerts, configure the auto-close timeout:

Field	Value
Auto-resolve timeout (required)	On
Window timing start (required)	Incident trigger
Timeout duration (required)	1 hour recommended

After the condition clears, the alert closes when the timeout is reached; if the condition still holds, the monitor’s next notification after the auto-close creates the alert again.

Send a test message in OpenSearch Dashboards and verify

Where: OpenSearch Dashboards › Management › Notifications › Channels › the channel › Send test message

Open the channel and click Send test message. Flashduty opens an Info alert titled OpenSearch test notification and the integration shows a Latest event time; close the alert manually after verifying. This test message only proves connectivity; it carries no monitor or trigger information
Make the trigger condition actually hold (for example, temporarily lower the threshold), wait for the next monitor run, and confirm Flashduty receives an alert whose severity matches the trigger’s Severity level
Restore the threshold, wait for the auto-close timeout to be reached, and confirm the alert closes on its own

Alert key

Flashduty computes the Alert Key from the monitor ID and the trigger ID, which are monitor_id and trigger_id in the template. Every notification from the same trigger of the same monitor uses the same Alert Key and merges into one alert; different triggers and different monitors each get their own alert. Changes to the monitor name, trigger name, severity, hit count, or time period do not change the Alert Key. A notification with an empty monitor_id or trigger_id is rejected with an invalid-parameter error. The template does not use ctx.alert.id: when a trigger runs its action for the first time, OpenSearch has not created the alert yet, so the variable is empty.

Status and severity

The trigger’s Severity level ranges from 1 (highest) to 5 (lowest). Flashduty maps it as follows:

Severity level	Flashduty severity
1, 2	Critical
3	Warning
4, 5	Info
Empty or any other value	Warning

Every notification is a trigger. Flashduty never recovers an alert because of an OpenSearch notification; recovery comes from auto-close, or you can close the alert manually in Flashduty.

Labels

Label	Source
`check`	Monitor name and trigger name, in the form `Monitor name: Trigger name`
`monitor_id` / `monitor_name`	ID and name of the monitor
`trigger_id` / `trigger_name`	ID and name of the trigger
`severity`	Raw Severity level of the trigger
`period_start` / `period_end`	Time period of this monitor run
`hit_count`	Number of documents the query matched (per query monitors only)
`error`	Error message when the trigger could not get results or evaluate its condition

Troubleshooting

Flashduty returns an invalid-parameter error: make sure Message holds the complete template with values for both monitor_id and trigger_id, and that the URL is complete and includes integration_key
The notification fails in OpenSearch: click Send test message on the channel in Notifications → Channels to see the error. Common causes are a cluster that cannot reach api.flashcat.cloud or a domain listed in host_deny_list
The alert does not close automatically: confirm the channel has auto-close turned on, and the window timing start is Incident trigger
No new notifications after you acknowledge the alert in OpenSearch: OpenSearch stops running actions for an acknowledged alert, and the Flashduty alert closes when auto-close expires
The alert title has an empty trigger name: when the trigger has no name, Flashduty titles the alert with the monitor name only; when both are empty, the title is OpenSearch alert: <trigger ID>

For more on the variables, see OpenSearch Alerting triggers and Notifications channels.

Quick Start

Product Comparison

Channels

Incident Management

Post-Mortem

Status Page

Analytics

Integration Settings

Configuration

Advanced

Integrations

Best Practices

OpenSearch alert integration

In Flashduty On-call

Use a dedicated integration

Use a shared integration

Configure OpenSearch

Alert key

Status and severity

Labels

Troubleshooting