:Ingest Cloud Eye alerts into Log Service

Configure Cloud Eye

1. Log on to the SMN console.
2. Create a topic.
   In the Create Topic dialog box, set the Topic Name parameter. For more information, see Create a topic.
3. Add a subscription.
   In the Add Subscription dialog box, set the parameters. The following table describes the parameters. For more information, see Add a Subscription.

   Parameter	Description
   Protocol	Select HTTP.
   Endpoint	In this example, enter the full URL of the webhook URL that is generated after you create an alert ingestion service and an alert ingestion application in the alert ingestion system of Log Service. For more information, see Obtain webhook URLs.

   After the configuration is completed, your subscription is in the Pending confirmation state. In this case, SMN sends a subscription confirmation message to Log Service. When Log Service receives the message, Log Service automatically accesses the link in the message. After the link is accessed, your subscription changes to the Confirmed state, and your subscription succeeds.

   Note If your subscription fails, select your subscription and click Request confirmation to send another subscription confirmation message. If your subscription still fails, view the error log in Troubleshooting Center of Alert Center in the Log Service console.

   
4. Log on to the Cloud Eye console.
5. Create an alert rule and an alert notification method.
   On the Create Alarm Rule page, configure an alert rule and an alert notification method. After you create an alert rule, alerts that are triggered based on the alert rule are sent to the alert ingestion system of Log Service. For more information, see Creating an Alarm Rule.

   Parameter	Description
   Notification Object	The object that receives alert notifications. Select the topic that you created in Step 2.
   Validity Period	The period for which the alert rule is valid. During this period, Cloud Eye can send alert notifications based on the alerts that are triggered by the alert rule.
   Trigger Condition	The conditions that trigger alert notifications. Select Generated alarm and Cleared alarm.

Cloud Eye alerts

{
    "signature": "NR9taTRU****qH0D8htN",
    "subject": "[Major Alarm] Cloud Eye Notification: Host monitoring - An alarm is triggered for the (Agent) CPU utilization of ECS "hecs****6789".",
    "topic_urn": "urn:smn:cn-east-3:1a2b3c4d5e6f7g:tosls",
    "message_id": "1a2b3c4d5e6f7g8h9i",
    "signature_version": "v1",
    "type": "Notification",
    "message":
    {
        "message_type": "alarm",
        "alarm_id": "al1234567890",
        "alarm_name": "alarm-abc",
        "alarm_status": "alarm",
        "time": 1640704721540,
        "namespace": "AGT.ECS",
        "metric_name": "cpu_usage",
        "dimension": "instance_id:eee12****3b4c",
        "period": 1,
        "filter": "Raw data",
        "comparison_operator": ">=",
        "value": 5,
        "unit": "%",
        "count": 1,
        "alarmValue":
        [
            {
                "time": 1640704680000,
                "value": 5.7
            }
        ],
        "sms_content": "[CN East-Shanghai1][Major Alarm] Dear hid_1a2b3c: Host monitoring - The original value of the (Agent) CPU utilization of ECS " hecs****6789 "(private IP: 192.168.0.11, public IP: 192.0.2.1, ID: eee12****3b4c) (Agent) is greater than or equal to (>=) 5.00% for one time. Current value: 5.70%. The alarm was triggered at 2021/12/28 23:18:41 GMT +08:00. For more information, visit Cloud Eye.",
        "template_variable":
        {
            "AccountName": "hid_1a2b3c",
            "Namespace": "Host monitoring",
            "DimensionName": "ECS",
            "ResourceName": "hecs****6789",
            "MetricName": "(Agent) CPU utilization",
            "IsAlarm": true,
            "IsCycleTrigger": false,
            "AlarmLevel": "Major",
            "Region": "CN East-Shanghai1",
            "ResourceId": "eee****3b4c",
            "PrivateIp": "192.168.0.11",
            "PublicIp": "192.0.2.1",
            "AlarmRule": "",
            "CurrentData": "5.70%",
            "AlarmTime": "2021/12/28 23:18:41 GMT+08:00",
            "DataPoint":
            {
                "2021/12/28 23:18:00 GMT+08:00": "5.70%"
            },
            "DataPointTime":
            [
                "2021/12/28 23:18:00 GMT+08:00"
            ],
            "AlarmRuleName": "alarm-abc",
            "AlarmId": "al1234567890",
            "AlarmDesc": "test alarm",
            "MonitoringRange": "Resource group",
            "IsOriginalValue": true,
            "Period": "",
            "Filter": "Original value",
            "ComparisonOperator": ">=",
            "Value": "5.00%",
            "Unit": "%",
            "Count": 1,
            "EventContent": "",
            "Link": "https://console.huaweicloud.com/ces/?region=cn-east-3#/alarms/detail?alarmId=al1234567890",
            "IsIEC": false,
            "IsAgentEvent": false,
            "IngressMaxBandwidthPerSec": "",
            "EgressMaxBandwidthPerSec": ""
        }
    },
    "unsubscribe_url": "https://console.huaweicloud.com/smn/subscription/unsubscribe?region=cn-east-3&region_id=cn-east-3&subscription_urn=urn:smn:cn-east-3:1a2b3c4d5e6f:tosls:1a2b3c4d5e6f",
    "signing_cert_url": "https://smn.cn-east-3.myhuaweicloud.com/smn/SMN_cn-east-3_1a2b3c4d5e6f7h.pem",
    "timestamp": "2021-12-28T15:20:06Z"
}

Field mappings

After a Cloud Eye alert is ingested into Log Service, the alert is converted to an alert that is supported by Log Service by using field mapping. The following example shows the fields of a Log Service alert:

{
    "aliuid": "aliuid1",
    "alert_instance_id": "1a2b3c4d5e6f7g8h9i",
    "alert_id": "al1234567890",
    "alert_type": "sls_pub",
    "alert_name": "alarm-abc",
    "region": "{The region where the project resides}",
    "project": "{The project to which Alert Center belongs}",
    "project_id": 0,
    "next_eval_interval": 1,
    "alert_time": 1640704721,
    "fire_time": 1640704721,
    "fire_results":
    [
        {
            "time": "1640704680000",
            "value": "5.7"
        }
    ],
    "fire_results_count": 1,
    "resolve_time": 0,
    "status": "firing",
    "results": null,
    "labels":
    {
        "dimension": "instance_id:eee****3b4c",
        "dimension_name": "HUAWEI CLOUD ECS",
        "metric_name": "cpu_usage",
        "namespace": "AGT.ECS",
        "region": "CN East-Shanghai1"
    },
    "annotations":
    {
        "__config_app__": "sls_pub_alert",
        "__pub_alert_app__": "{The ID of the alert ingestion application}",
        "__pub_alert_protocol__": "huawei_ces",
        "__pub_alert_region__": "{The region of the endpoint to which the alert is sent}",
        "__pub_alert_service__": "{The ID of the alert ingestion service}",
        "account_name": "hid_1a2b3c",
        "comparison_operator": ">=",
        "desc": "test alarm",
        "title": "[Major Alarm] Cloud Eye Notification: Host monitoring - An alarm is triggered for the (Agent) CPU utilization of ECS "hecs****6789".",
        "unit": "%"
    },
    "severity": 8,
    "policy":
    {
        "alert_policy_id": "{The alert policy that is specified for the alert ingestion application}",
        "action_policy_id": "{The action policy that is specified for the alert ingestion application}",
        "use_default": false,
        "repeat_interval": "{The cycle that is specified for the alert ingestion application}"
    },
    "template": null,
    "drill_down_query": "https://console.huaweicloud.com/ces/?region=cn-east-3#/alarms/detail?alarmId=al1234567890"
}