Alert filter (regex match) when alert is created
Asked by Tu Lan:

Hi Atlassian team,

My question is about the Alert filter functionality. I want to know how to do it by using Alert Filter -\> Alert Actions to filter alarms when it is just created. I know there's a obvious way to do it by selecting the 'Create' box under Alter Action. But my question is how to do it by using Alert Filter, because I do have others filtering rules to come with that. Could you show me what is the regex rules that matches with my request? Something like policy on the attached image. Thank you for your help and time. ![Screenshot 2023-03-05 at 9.28.05 am.png](/t5/image/serverpage/image-id/243850i189BBDE30F3621E7/image-size/large?v=v2&px=999 "Screenshot 2023-03-05 at 9.28.05 am.png")  

<br />


Answers:
author: Nick H
body: Hi [@Tu Lan](/t5/user/viewprofilepage/user-id/5162463) ,

Those [alert actions](https://support.atlassian.com/opsgenie/docs/how-to-use-alert-actions/) refer to what can be found here on an alert:

![alertaction1.jpg](https://community.atlassian.com/t5/image/serverpage/image-id/244016iC5899BB0B0B55EAC/image-size/large?v=v2&px=999 "alertaction1.jpg")

Highlighted above are a few custom actions that can be added by an [integration](https://support.atlassian.com/opsgenie/docs/set-up-a-custom-action-alert/#Set-up-a-custom-action-from-an-integration) or through an alert policy:

![alertaction2.jpg](https://community.atlassian.com/t5/image/serverpage/image-id/244017i7B3F6FF3D2DB5E4E/image-size/large?v=v2&px=999 "alertaction2.jpg")![alertaction3.jpg](https://community.atlassian.com/t5/image/serverpage/image-id/244018iF43686809D13A9B0/image-size/large?v=v2&px=999 "alertaction3.jpg")

For example with Slack, if I were to filter on the alert actions with a similar filter to yours using regex, this would match:

![alertaction4.jpg](https://community.atlassian.com/t5/image/serverpage/image-id/244019i9DB8A7DAE3CEA87F/image-size/large?v=v2&px=999 "alertaction4.jpg")![alertaction5.jpg](https://community.atlassian.com/t5/image/serverpage/image-id/244020iBB1E2AC07A8B8B06/image-size/large?v=v2&px=999 "alertaction5.jpg")

comments: author: Tu Lan
body: Hi Nick,

Thank you so much for your help. I assume the custom action is created by any integration that has a "Matches all alert" filter policy is this is correct?


author: Tu Lan
body: Hi Nick,  
Thanks again for your help. I am not fully understand the mechanism behind the scene, I've tried to create custom actions throughout integration of an API. But the custom action e.g \`Create Issue\` doesn't appear to my side after created.

However, throughout the investigation, I realised my problem could also be solved by filtering out default alert actions with \`Not\` Operation, e.g alert action not matches(regex) acknowledge, but no luck here. Could you please give me some guidance by not using the customised alerts action to remove any alert information when it is acknowledged and etc. Many thanks here! ![Screenshot 2023-03-07 at 11.09.44 am.png](https://community.atlassian.com/t5/image/serverpage/image-id/244160iF16CC5DE6C06E089/image-size/large?v=v2&px=999 "Screenshot 2023-03-07 at 11.09.44 am.png")


author: Nick H
body: I'm not entirely sure what your use case is to filter on the Alert Actions.

If you do not want these actions taken on the alert posted in your Slack channel, then you can simply unselect them under the checkboxes of the integration here:

![slack1.jpg](https://community.atlassian.com/t5/image/serverpage/image-id/244323i04927F96AA93A360/image-size/large?v=v2&px=999 "slack1.jpg")

By default, these are included to send to the Slack channel you have configured in the integration. The idea behind the filter of the Slack integration is to determine which alerts should (or should not) send to the Slack channel. If you have something like this:

![slack2.jpg](https://community.atlassian.com/t5/image/serverpage/image-id/244324iA24EC77C5A5465E2/image-size/large?v=v2&px=999 "slack2.jpg")

\^ only P1 and P2 alerts will send to the #community Slack channel configured in my integration.

The Alert Actions section of the Slack integration can send all, or a subset of actions taken on the alert to the channel.


author: Tu Lan
body: Hi Nick,

Thanks so much for your help, now the problem is solved. My previous misunderstanding is that: the filter policy is only going be applied either by ticking off those 'Alert Actions' boxes, or using 'Alert Filter'. But it turns out it both contribute to the filtering policy at the same time. Thanks a lot for your help throughout the problem, cheers.


Tags: cloud

slack