> ## Documentation Index
> Fetch the complete documentation index at: https://docs.flashduty.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Sumo Logic alert integration

> Send Sumo Logic Monitor alert and recovery events to Flashduty On-call through a webhook.

Use a Sumo Logic webhook to send Monitor alerts to Flashduty On-call. Each Sumo Logic alert response maps to one Flashduty alert. Trigger, update, and recovery notifications in the same lifecycle continue updating that alert.

<div className="hide">
  ## In Flashduty On-call

  ***

  Create either a dedicated or shared **Sumo Logic** alert integration and copy its complete Push URL.
</div>

## Configure Sumo Logic

***

<Steps>
  <Step title="Create a webhook connection">
    1. In the new UI, go to **Monitoring → Connections**. In the classic UI, go to **Manage Data → Monitoring → Connections**
    2. Click **+ Add** and select **Webhook** as the connection type
    3. Name the connection `Flashduty`
    4. Paste the complete Flashduty integration Push URL into **URL**
  </Step>

  <Step title="Configure alert and recovery payloads">
    Paste the same JSON into both **Alert Payload** and **Recovery Payload**:

    ```json theme={null}
    {
      "alert_response_id": "{{AlertResponseId}}",
      "monitor_id": "{{Id}}",
      "alert_name": "{{AlertName}}",
      "name": "{{Name}}",
      "description": "{{Description}}",
      "monitor_type": "{{MonitorType}}",
      "detection_method": "{{DetectionMethod}}",
      "trigger_type": "{{TriggerType}}",
      "trigger_time_start": "{{TriggerTimeStart}}",
      "trigger_time_end": "{{TriggerTimeEnd}}",
      "trigger_condition": "{{TriggerCondition}}",
      "trigger_value": "{{TriggerValue}}",
      "alert_group": "{{AlertGroup}}",
      "query": "{{Query}}",
      "query_url": "{{QueryURL}}",
      "source_url": "{{SourceURL}}",
      "alert_response_url": "{{AlertResponseUrl}}"
    }
    ```

    Keep `alert_response_id` and `trigger_type`, and use the same payload for alert and recovery notifications. Flashduty rejects a missing `alert_response_id` because later updates and recovery cannot otherwise be correlated reliably.
  </Step>

  <Step title="Attach the connection to a monitor">
    Create or edit a Monitor, select the `Flashduty` connection in its notification settings, and enable both alert and recovery notifications.
  </Step>

  <Step title="Verify the lifecycle">
    Make the Monitor cross its threshold and confirm an active Flashduty alert. Then return the data to normal and confirm that the original alert recovers. The connection test button proves webhook connectivity only, not real lifecycle correlation.
  </Step>
</Steps>

## Alert Key

***

Flashduty uses `AlertResponseId` directly as the Alert Key. Sumo Logic defines it as the unique identifier of the triggered alert. A real Monitor test also confirmed that a `Critical` trigger and its `ResolvedCritical` recovery carry the same `AlertResponseId`.

`Id` identifies the Monitor. A grouped Monitor can produce independent alerts, so the Monitor ID is stored only as context and is not used by itself as the Alert Key. Changes to the title, severity, time range, trigger value, or `AlertGroup` do not change the Alert Key.

## Status and severity

***

| Sumo Logic `TriggerType` | Flashduty status or severity          |
| :----------------------- | :------------------------------------ |
| `Critical`               | Critical                              |
| `Warning`                | Warning                               |
| `Missing Data`           | Warning                               |
| `Normal`                 | Recovered                             |
| `ResolvedCritical`       | Recovered; original severity Critical |
| `ResolvedWarning`        | Recovered; original severity Warning  |
| `ResolvedMissingData`    | Recovered; original severity Warning  |

An empty or unknown `TriggerType` is rejected so that an ambiguous request cannot enter the wrong alert lifecycle.

## Troubleshooting

***

* **Sumo Logic receives a non-2xx response**: verify that the full Push URL includes `integration_key`
* **Flashduty reports an invalid parameter**: verify valid JSON and non-empty `alert_response_id` and `trigger_type` fields
* **The alert does not recover**: configure the Recovery Payload and enable recovery notifications on the Monitor
* **Grouped alerts overwrite each other**: use `{{AlertResponseId}}`; do not replace it with `{{Id}}`
* **The test succeeds but real alerts do not arrive**: verify that the Monitor is enabled, its threshold is actually crossed, and it uses this connection

See [Sumo Logic Alert Variables](https://www.sumologic.com/help/docs/alerts/monitors/alert-variables/) and [Webhook Connections](https://www.sumologic.com/help/docs/alerts/webhook-connections/set-up-webhook-connections/) for the vendor field definitions and connection workflow.