It appears that Event Rules stop processing once the first matching rule is found, starting from the top. There does not appear to be a way to continue processing rules. In VictorOps, we had many transmogrifier rules to do various things, such as adding wiki links as a note, and it has the ability to either continue processing rules or stop processing rules, within each rule. Without the ability to continue processing rules, we’d need to have more rules that are using multiple conditions (and multiple actions). A simple example would be that we have a rule for lowering the severity based on a condition, and we want to have 20 rules that add notes with wiki page links or some text. If we could set it such that rules could continue to process, we’d only need 21 rules. As it is now, we’d need to have 40 rules (20 rules that include the condition for the severity and the note, and 20 rules that don’t have the severity condition and only conditions/actions for adding the notes). The number of rules can increase a lot if there are more conditions/actions needed per rule.
I work on the Product team here at PagerDuty and I appreciate your feedback. Your analysis is correct - the current state of event rules will process once per scope. You can, for example, define a Global Event Rule that routes to a service, and layer on a rule from there. In your example, you can add notes as a Global Event Rule and then differentiate the severity as a Service Event Rule. Please let me know if that pattern can unblock you.
We are working on allowing for more flexibility with event rules in the future – thank you for your explanation, it helps us a ton!
Hi Lilia, thanks for the info. In our case, we have an account that is shared among multiple teams in Thomson Reuters, and we don’t have access to global event rules. We could probably work with the team in charge of the account to add
the note rules for us if needed. Our plan for now is to try to add wiki links in our Datadog monitors themselves as that will come through to the PagerDuty incident. That only covers Datadog, but that is our main integration.