"The query in severity warn does not match the one in alertSources.query" ERROR

Products

• Insights

Issue/Introduction

This article applies to:

• Alerting

• Product edition: All

• Feature Category: Alerts

 

Overview

When creating an alert using Aria Apps API POST /api/v2/alert, error "The query in severity warn does not match the one in alertSources.query" ERROR could be received some scenarios/symptoms could be:

• Creating alert via Terraform
• Creating alert based on GET /api/v2/alert/{alert_id} output

Cause

This happens because the displayExpression is different than the severe/warn conditions in the alert payload. They both need to match and hence this error returned, example:

• Incorrect

Resolution

A correct alert payload should look like:

• This happens often if the user uses GET alert API output to create an alert based on the output.

If Alert conditions severe/warn/info/smoke expressions are different the same error is received, for example:

• This payload will output error.

Terraform example:

### Terraform resource :
resource "wavefront_alert" "Temporal-frontend-service-availability-lv7" {
name = "Temporal-frontend-service-availability-lv7"
alert_type = "THRESHOLD"
additional_information = "Temporal-frontend-service-availability-lv7"
display_expression = "sum(rate(ts(\"temporal-prod-lv7-frontend.service_errors*\")))/sum(rate(ts(\"temporal-prod-lv7-frontend.service_requests*\"))) * 100"
minutes = 20
resolve_after_minutes = 20
tags = ["dpsre-managed", "dpse.temporal-onprem.prod.lv7.frontend.service-availability", "dpsre.temporal"]
conditions = {
"severe" = "100 - (sum(rate(ts(\"temporal-prod-lv7-frontend.service_errors*\"))) * 100/sum(rate(ts(\"temporal-prod-lv7-frontend.service_requests*\")))) > 25"
"warn" = "100 - (sum(rate(ts(\"temporal-prod-lv7-frontend.service_errors*\"))) * 100 /sum(rate(ts(\"temporal-prod-lv7-frontend.service_requests*\")))) > 15"
}

threshold_targets = { "severe" : "target:low", "warn" : "target:high" }
}

In the above shared example, the display expression and severe/warn expression are different. It should be same

The first part of the conditions is the display expression which should be common for both severe/warn/info/smoke.  The conditions should only differ in values comparison (ex: > 90 is severe , > 70 is warn etc.) keeping the expression same.

See also:

Terraform Integration