How to filter Alert Processing Rule based on Name of Rule from Prometheus Rule Group?

Question

We are using multiple rules defined in a Prometheus Rule Group to create alerts based on Prometheus metrics. An alert processing rule is used to trigger an action group based on alerts. We want to add a filter condition so that certain alerts do not lead to firing the processing rule.

We have tried to put the names of the specific alert rules as they are displayed within the Prometheus Rule Group (see below), but this does not work:

{
    "field": "AlertRuleName",
    "operator": "NotEquals",
    "values": [
        "ErrorLogs",
        "ServiceDown"
    ]
}

We further tried an extended naming (see below), but this also does not work:

{
    "field": "AlertRuleName",
    "operator": "NotEquals",
    "values": [
        "amprg-euw-mysvc/ErrorLogs",
        "amprg-euw-mysvc/ServiceDown"
    ]
}

In the Azure Portal UI, rules from Prometheus Rule Groups are also not shown as available options in the filter selection dropdown.

Could you please let me know if it is possible to filter by alert rules from a Prometheus Rule Group and if yes - how these need to be specified in the filter condition?

Answer 1

Hi @Nils Siegfried ,

Thanks for the insights,

For a rule group we can write multiple conditions for the group as follows, and this will be applicable for different set of rules

Can you please try this and see how it goes

resource "azurerm_monitor_alert_processing_rule_action_group" "events" {
  name                = "events-action-group"
  resource_group_name = var.resource_group_name
  location            = var.location
  action_group_id     = azurerm_monitor_action_group.example.id
 
  condition {
    alert_rule_id {
      operator = "Equals"
      values   = [ azurerm_monitor_alert_prometheus_rule_group.ServiceDown.id ]
    }
  }
 
  condition {
    alert_rule_id {
      operator = "NotEquals"
      values   = [ azurerm_monitor_alert_prometheus_rule_group.NewInstanceRunning.id ]
    }
  }
}