Hi, I am trying to both trigger and resolve an incident for a service through a Event Rule with an e-mail.
I have setup a Service with e-mail integration. If I go directly through the service e-mail, I am able to both trigger and resolve the incident. But if I use the Event Rules to route the e-mail to the service, all I am able to do is to trigger the alert. The resolve is not working. The Alert Key is based on a static subject line for both the trigger and resolve and I see both the service and Event Rule paths combining the e-mails. This can be seen when I send the restore to the event rule. It is added to the triggered incident and can be seen in the timeline.
The e-mail that is being sent is very simple. The subject line stays the same. And the only thing in the body is either resolve or trigger.
On the Service, the Integration is set to e-mail.
The e-mail management is set to “Open and Restore alerts based on custom rules” setting.
I have two rules: one that triggers based on one word “trigger” in the body and one that resolves based on one word “resolve” in the body. They both use the same alert key of the email subject matching everything.
Both Rules are also set to match all the conditions.
And then discard any e-mail that does not match any of the rules above.
If I go to the e-mail address of this service, It works. I can both trigger and resolve the incident.
The problem is that when I use the e-mail address in the event rules and then create a custom event rule that routes the e-mail to the above service, I am only able to trigger an incident. The resolve does not work.
The Event Rule is set to look at the e-mail subject equals static project name that stays the same for all e-mails for this incident rule.
The Event Behavior is set to “perform the trigger or resolve specified by the event’s payload.
For the dedup_key, I have tried letting it auto extract it from the subject and manually extracting it. note that the e-mails do seem to get merged into one incident so I’m assuming that this is working.
Alert Behavior is set to route alert to a service. The one described above.
Incident behavior is set to create an incident.
The Event Rule is passing the e-mails to the Service and Triggering the Incident.
However, I’m not sure what else I need to do to get the same Event Rule to also resolve the Incident. It is seeing the e-mail with resolve in the body and that e-mail is being added to the same incident that the Trigger e-mail is on.
Under the Event Behavior, it states the trigger or resolve is based on the event’s payload.
The event e-mail payload is in the body of the e-mail. The only thing in the body has either trigger or resolve.
I’m assuming that since I’m having the event rule route the e-mail to the service, that the service would directly act on the e-mail either trigger or resolve based on the rules in the service email integration. However, this does not seem to be the case.
I’ve been through all the documentation that I could find and am following everything that I see but nothing seems to work for resolving using the same event rule as the trigger.
Any Help would be much appreciated,