Skip to main content

Alert Filters

Renamed API

The Alert Filter Plans API was previously called V1 Maintenance Plans or V1 Plans. The functionality of the API has not changed, but the name has been updated to clarify which BigPanda feature the API manages.

The Alert Filter Plans API enables users to set and maintain alert filters to reduce noise for operators.

Plans are configured with BPQL queries and, once activated, will suppress alerts that match the criteria.

The Alert Filters API can be used to manage Alert Filters that have been configured in the BigPanda API. Alert filters affect alerts after they have been normalized and enriched, enabling complex filters based on additional metadata and enrichment tags. The plan ID for alert filters is the last 24 characters in the filter URL.

Alert Filter Schedules define a start and stop time frame for the alert filter. If a filter does not have a schedule defined, it will start immediately and run indefinitely - filtering all matching alerts until deactivated.

Schedule ID

The schedule ID is needed to add the schedule to a filter.

Plan Limit

Each organization can have up to 3,500 V1 alert filters.

Condition limitations

Alert filter conditions cannot be longer than 25,000 characters long.

All alert tags in alert filter conditions are case-insensitive.

OK status

By default, alert filters ignore events that have an ok status. These events will still enter the system and resolve any related open alerts.

This setting can be changed by explicitly including the exclude_status field as an empty array.

Filter ID

The plan id for Alert filters created in the BigPanda UI can be extracted from the URL.

Alert Filters

Authentication

All BigPanda APIs require Bearer Token Authorization in the call headers.

This API uses the Org Token type of Authorization token.

BigPanda recommends adding Authentication headers only in the secure tool you use to make API calls.

Example 1. Create an alert filter
curl --request POST \
     --url https://api.bigpanda.io/resources/v1.0/plans \
     --header 'Authorization: Bearer <Org Token>' \
     --header 'accept: application/json' \
     --header 'content-type: application/json' \
     --data '
{
  "active": true,
  "exclude_status": [
    "Ok",
    "Critical"
  ],
  "name": "weekend maintenance",
  "bpql": {
    "=": [
      "host",
      {
        "type": "regex",
        "value": "prod-api-*"
      }
    ]
  },
  "custom_tags": [
    {
      "name": "check",
      "value": "CPU*"
    }
  ],
  "schedule": "12346161",
  "description": "Suppression during server refresh"
}
'
curl --request POST \
     --url https://eu-api.bigpanda.io/resources/v1.0/plans \
     --header 'Authorization: Bearer <Org Token>' \
     --header 'accept: application/json' \
     --header 'content-type: application/json' \
     --data '
{
  "active": true,
  "exclude_status": [
    "Ok",
    "Critical"
  ],
  "name": "weekend maintenance",
  "bpql": {
    "=": [
      "host",
      {
        "type": "regex",
        "value": "prod-api-*"
      }
    ]
  },
  "custom_tags": [
    {
      "name": "check",
      "value": "CPU*"
    }
  ],
  "schedule": "12346161",
  "description": "Suppression during server refresh"
}
'


Example 2. Retrieve an alert filter
curl --request GET \
     --url https://api.bigpanda.io/resources/v1.0/plans/590b3a991f00002000637538 \
     --header 'Content-Type: application/merge-patch+json; charset=utf-8' \
     --header 'Accept: application/json' \
     --header 'Authorization: Bearer <ORG TOKEN>'
curl --request GET \
     --url https://eu-api.bigpanda.io/resources/v1.0/plans/590b3a991f00002000637538 \
     --header 'Content-Type: application/merge-patch+json; charset=utf-8' \
     --header 'Accept: application/json' \
     --header 'Authorization: Bearer <ORG TOKEN>'


Example 3. Retrieve all alert filters
curl --request GET \
     --url https://api.bigpanda.io/resources/v1.0/plans \
     --header 'Accept: application/json' \
     --header 'Authorization: Bearer <ORG TOKEN>'
curl --request GET \
     --url https://eu-api.bigpanda.io/resources/v1.0/plans \
     --header 'Accept: application/json' \
     --header 'Authorization: Bearer <ORG TOKEN>'


Example 4. Update an alert filter
curl --request PATCH
     --url https://api.bigpanda.io/resources/v1.0/plans/${id} \
     --header 'Content-Type: application/json; charset=utf-8' \
     --header 'Authorization: Bearer <ORG TOKEN>}' \
     --data '{
        "active": false
    }'
curl --request PATCH
     --url https://eu-api.bigpanda.io/resources/v1.0/plans/${id} \
     --header 'Content-Type: application/json; charset=utf-8' \
     --header 'Authorization: Bearer <ORG TOKEN>}' \
     --data '{
        "active": false
    }'


Example 5. Delete an alert filter
curl --request DELETE \
     --url https://eu-api.bigpanda.io/resources/v1.0/plans/${id} \
     --header 'Content-Type: application/json; charset=utf-8' \
     --header 'Authorization: Bearer <ORG TOKEN>'
curl --request DELETE \
     --url https://eu-api.bigpanda.io/resources/v1.0/plans/${id} \
     --header 'Content-Type: application/json; charset=utf-8' \
     --header 'Authorization: Bearer <ORG TOKEN>'


Example 6. Create an alert filter schedule
curl --request POST \
     --url https://api.bigpanda.io/resources/v1.0/schedules \
     --header 'Content-Type: application/json; charset=utf-8' \
     --header 'Accept: application/json' \
     --header 'Authorization: Bearer <ORG TOKEN>' \
     --data '{
		    "name": "Weekend Maintenance",
		    "starts_on": 1491265491,
		    "ends_on": 1491294307,
		    "active": true
		  }
'
curl --request POST \
     --url https://eu-api.bigpanda.io/resources/v1.0/schedules \
     --header 'Content-Type: application/json; charset=utf-8' \
     --header 'Accept: application/json' \
     --header 'Authorization: Bearer <ORG TOKEN>' \
     --data '{
		    "name": "Weekend Maintenance",
		    "starts_on": 1491265491,
		    "ends_on": 1491294307,
		    "active": true
		  }
'


Example 7. Retrieve an alert filter schedule
curl --request GET \
     --url https://api.bigpanda.io/resources/v1.0/schedules/019823571032f242g6 \
     --header 'Content-Type: application/merge-patch+json; charset=utf-8' \
     --header 'Accept: application/json' \
     --header 'Authorization: Bearer <ORG TOKEN>'
curl --request GET \
     --url https://eu-api.bigpanda.io/resources/v1.0/schedules/019823571032f242g6 \
     --header 'Content-Type: application/merge-patch+json; charset=utf-8' \
     --header 'Accept: application/json' \
     --header 'Authorization: Bearer <ORG TOKEN>'


Example 8. Retrieve all alert filter schedules
curl --request GET \
     --url https://api.bigpanda.io/resources/v1.0/schedules \
     --header 'Content-Type: application/merge-patch+json; charset=utf-8' \
     --header 'Accept: application/json' \
     --header 'Authorization: Bearer <ORG TOKEN>'
curl --request GET \
     --url https://eu-api.bigpanda.io/resources/v1.0/schedules \
     --header 'Content-Type: application/merge-patch+json; charset=utf-8' \
     --header 'Accept: application/json' \
     --header 'Authorization: Bearer <ORG TOKEN>'


Example 9. Update an alert filter schedule
curl --request PATCH \
     --url https://api.bigpanda.io/resources/v1.0/schedules/{id} \
     --header 'Content-Type: application/json; charset=utf-8' \
     --header 'Accept: application/json' \
     --header 'Authorization: Bearer <ORG TOKEN>' \
     --data '{
		    "name": "Weekend Maintenance",
		    "starts_on": 1491265491,
		    "ends_on": 1491294307,
		    "active": true
		  }
'
curl --request PATCH \
     --url https://eu-api.bigpanda.io/resources/v1.0/schedules/{id} \
     --header 'Content-Type: application/json; charset=utf-8' \
     --header 'Accept: application/json' \
     --header 'Authorization: Bearer <ORG TOKEN>' \
     --data '{
		    "name": "Weekend Maintenance",
		    "starts_on": 1491265491,
		    "ends_on": 1491294307,
		    "active": true
		  }
'


Example 10. Delete an alert filter schedule
curl --request DELETE \
     --url https://eu-api.bigpanda.io/resources/v1.0/schedules/{id} \
     --header 'Content-Type: application/json; charset=utf-8' \
     --header 'Authorization: Bearer <ORG TOKEN>'
curl --request DELETE \
     --url https://eu-api.bigpanda.io/resources/v1.0/schedules/{id} \
     --header 'Content-Type: application/json; charset=utf-8' \
     --header 'Authorization: Bearer <ORG TOKEN>'


In this section: