I am having trouble understanding how to automatically resolve events that are being routed to an Event Rules integration via Email.
On an individual service, the Email integration allows you to “Link incoming emails to the same alert” and define rules that create and resolve the incidents based on the payload of the Email, IE, subject has “Problem Created” - create incident, subject has “Problem Close” - close incident.
Unfortunately, I am not seeing the ability to configure similar behavior via Event Rules + Email.
The use case is this - we want to configure the source sending Email notifications to send to a single Event Rules Integration. From there, we would like certain messages to route to a “Business Hours” service, and other messages to route to a “24x7” service. We would like these to automatically close, as well, when the appropriate email is sent.
That incident creation is easy to setup, but what is not easily achieved is the ability to Resolve those same Incidents when the associated “Problem Closed” message is sent. Based on my testing, it will just create another incident with “Problem Closed” message, result being 2 incidents for one event - Problem Open and Problem Closed incident(s).
Is there someone with experience in setting something up similar to this that may have some insight on best practices?