# Buggy code
def is_flapping(self, alert, window=1800, count=2):
    """
    Return true if alert severity has changed more than X times in Y seconds
    """
    pipeline = [
        {
            "$match": {
                "environment": alert.environment,
                "resource": alert.resource,
                "event": alert.event,
            }
        },
        {"$unwind": "$history"},
        {
            "$match": {
                "history.updateTime": {
                    "$gt": datetime.utcnow() - timedelta(seconds=window)
                }
            },
            "history.type": "severity",
        },
        {"$group": {"_id": "$history.type", "count": {"$sum": 1}}},
    ]
    responses = g.db.alerts.aggregate(pipeline)
    for r in responses:
        if r["count"] > count:
            return True
    return False


# Traceback (pymongo.errors.OperationFailure)
2018-01-26 11:04:16,782 - alerta.plugins.flapping[9]: INFO - recieved exception [in /usr/local/lib/python3.6/site-packages/alerta_flapping-1.0.1-py3.6.egg/alerta_flapping.py:28]
2018-01-26 11:04:16,782 - alerta.plugins.flapping[9]: ERROR - A pipeline stage specification object must contain exactly one field. [in /usr/local/lib/python3.6/site-packages/alerta_flapping-1.0.1-py3.6.egg/alerta_flapping.py:29]
Traceback (most recent call last):
File "/usr/local/lib/python3.6/site-packages/alerta_flapping-1.0.1-py3.6.egg/alerta_flapping.py", line 14, in pre_receive
result = alert.is_flapping(count=FLAPPING_COUNT, window=FLAPPING_WINDOW)
File "/usr/local/lib/python3.6/site-packages/alerta/models/alert.py", line 223, in is_flapping
return db.is_flapping(self, window, count)
File "/usr/local/lib/python3.6/site-packages/alerta/database/backends/mongodb/base.py", line 144, in is_flapping
responses = g.db.alerts.aggregate(pipeline)
File "/usr/local/lib/python3.6/site-packages/pymongo/collection.py", line 2181, in aggregate
**kwargs)
File "/usr/local/lib/python3.6/site-packages/pymongo/collection.py", line 2088, in _aggregate
client=self.__database.client)
File "/usr/local/lib/python3.6/site-packages/pymongo/pool.py", line 496, in command
collation=collation)
File "/usr/local/lib/python3.6/site-packages/pymongo/network.py", line 125, in command
parse_write_concern_error=parse_write_concern_error)
File "/usr/local/lib/python3.6/site-packages/pymongo/helpers.py", line 146, in _check_command_response
raise OperationFailure(msg % errmsg, code, response)
pymongo.errors.OperationFailure: A pipeline stage specification object must contain exactly one field.

# Fixed code
def is_flapping(self, alert, window=1800, count=2):
    """
    Return true if alert severity has changed more than X times in Y seconds
    """
    pipeline = [
        {
            "$match": {
                "environment": alert.environment,
                "resource": alert.resource,
                "event": alert.event,
                "customer": alert.customer,
            }
        },
        {"$unwind": "$history"},
        {
            "$match": {
                "history.updateTime": {
                    "$gt": datetime.utcnow() - timedelta(seconds=window)
                },
                "history.type": "severity",
            }
        },
        {"$group": {"_id": "$history.type", "count": {"$sum": 1}}},
    ]
    responses = g.db.alerts.aggregate(pipeline)
    for r in responses:
        if r["count"] > count:
            return True
    return False