Sumo Logic alert integration

Use a Sumo Logic webhook to send Monitor alerts to Flashduty On-call. Each Sumo Logic alert response maps to one Flashduty alert. Trigger, update, and recovery notifications in the same lifecycle continue updating that alert.

Configure Sumo Logic

Create a Webhook connection in Sumo Logic

Where: Sumo Logic › Monitoring › Connections › + Add (classic UI: Manage Data › Monitoring › Connections › + Add)

Field	Value
Connection Type (required)	`Webhook`
Name (required)	`Flashduty`
Description (optional)	Any description
URL (required)	`{integration_url}`
Authorization Header, Custom Headers (optional)	Not needed. Flashduty authenticates the request by the `integration_key` in the push URL

Configure the Alert and Recovery payloads

Where: Sumo Logic › Monitoring › ConnectionsPaste the same JSON into both Alert Payload and Recovery Payload (both are marked optional in Sumo Logic, but Flashduty needs them; without a Recovery Payload the alert cannot recover):

{
  "alert_response_id": "{{AlertResponseId}}",
  "monitor_id": "{{Id}}",
  "alert_name": "{{AlertName}}",
  "name": "{{Name}}",
  "description": "{{Description}}",
  "monitor_type": "{{MonitorType}}",
  "detection_method": "{{DetectionMethod}}",
  "trigger_type": "{{TriggerType}}",
  "trigger_time_start": "{{TriggerTimeStart}}",
  "trigger_time_end": "{{TriggerTimeEnd}}",
  "trigger_condition": "{{TriggerCondition}}",
  "trigger_value": "{{TriggerValue}}",
  "alert_group": "{{AlertGroup}}",
  "query": "{{Query}}",
  "query_url": "{{QueryURL}}",
  "source_url": "{{SourceURL}}",
  "alert_response_url": "{{AlertResponseUrl}}"
}

Keep alert_response_id and trigger_type, and use the same payload for alert and recovery notifications. Flashduty rejects a missing alert_response_id because later updates and recovery cannot otherwise be correlated reliably.

Click Test Connection; a 200 OK response means Sumo Logic can reach Flashduty. Test Alert Payload and Test Alert + Recovery Payload send Sumo Logic sample data and only check connectivity. Then click Save.

Use the connection in a Sumo Logic Monitor

Where: Sumo Logic › Notifications › Add Notifications

Field	Value
Connection Type (required)	`Webhook`, then select the `Flashduty` connection from the previous step
Alert checkbox on the Critical, Warning, and Missing Data rows (required)	Check the levels that should raise alerts
Recovery checkbox on the Critical, Warning, and Missing Data rows (required)	Check it as well; otherwise no recovery notification is sent and the Flashduty alert does not recover

The notification uses the payload configured on the connection by default; keep the default.

Trigger and confirm the alert lifecycle

Make the Monitor cross its threshold and confirm an active Flashduty alert. Then return the data to normal and confirm that the original alert recovers. The connection test button proves webhook connectivity only, not real lifecycle correlation.After a few seconds, go back to Flashduty. If the integration shows a Latest event time, the setup works.

Alert key

Flashduty uses AlertResponseId directly as the Alert Key. Sumo Logic defines it as the unique identifier of the triggered alert. A Critical trigger and its ResolvedCritical recovery carry the same AlertResponseId. Id identifies the Monitor. A grouped Monitor can produce independent alerts, so the Monitor ID is stored only as context and is not used by itself as the Alert Key. Changes to the title, severity, time range, trigger value, or AlertGroup do not change the Alert Key.

Status and severity

Sumo Logic `TriggerType`	Flashduty status or severity
`Critical`	Critical
`Warning`	Warning
`Missing Data`	Warning
`Normal`	Recovered
`ResolvedCritical`	Recovered; original severity Critical
`ResolvedWarning`	Recovered; original severity Warning
`ResolvedMissingData`	Recovered; original severity Warning

An empty or unknown TriggerType is rejected so that an ambiguous request cannot enter the wrong alert lifecycle.

Troubleshooting

Sumo Logic receives a non-2xx response: verify that the full Push URL includes integration_key
Flashduty reports an invalid parameter: verify valid JSON and non-empty alert_response_id and trigger_type fields
The alert does not recover: configure the Recovery Payload and enable recovery notifications on the Monitor
Grouped alerts overwrite each other: use {{AlertResponseId}}; do not replace it with {{Id}}
The test succeeds but real alerts do not arrive: verify that the Monitor is enabled, its threshold is actually crossed, and it uses this connection

See Sumo Logic Alert Variables and Webhook Connections for the vendor field definitions and connection workflow.

Quick Start

Product Comparison

Channels

Incident Management

Post-Mortem

Status Page

Analytics

Integration Settings

Configuration

Advanced

Integrations

Best Practices

Sumo Logic alert integration

In Flashduty On-call

Configure Sumo Logic

Alert key

Status and severity

Troubleshooting

​In Flashduty On-call

​Configure Sumo Logic

​Alert key

​Status and severity

​Troubleshooting

In Flashduty On-call

Configure Sumo Logic

Alert key

Status and severity

Troubleshooting