List of alerts from an incident in workflow

[logicall]

Hello!

Can you tell me if there is any way to get a list of alerts from an incident in workflow when creating or updating it?
I haven't found it in the examples.

Thanks!

[dosubot[bot]]

Yes, you can obtain a list of alerts from an incident in a workflow by using the API endpoint GET /incidents/{incident_id}/alerts ^[1].

To continue talking to Dosu, mention @dosu.

---

^{Help Dosu learn! Give it feedback: Great Response | Irrelevant Answer | Incorrect Sources | Too Verbose | Hallucination | Bug Report | Other}

[talboren]

Hey @logicall , you can actually do that with {{ incident.alerts }} which returns the list of alerts associated with a specific incident. Let me know if that's what you were looking for :)

[logicall]

I tried what you said
I get an error

Failed to run step console-action with error Could not find key 'incidents.alerts' in the context.

The event trigger does not pass {{ incidents.alerts }}

Here's the whole event.
{ "user_generated_name": "******", "assignee": null, "user_summary": null, "same_incident_in_the_past_id": "91012645-0f2b-4df4-a41c-ccda373685ac", "severity": "warning", "id": "c350f738-f03b-4dac-908b-245cdfd839d6", "start_time": "2025-04-15 00:21:54", "last_seen_time": "2025-04-28 00:10:53", "end_time": null, "creation_time": "2025-04-27 21:09:53", "alerts_count": 2, "alert_sources": [ "***" ], "status": "IncidentStatus.FIRING", "services": [ "****" ], "is_predicted": true, "is_candidate": false, "generated_summary": null, "ai_generated_name": null, "rule_fingerprint": "*****", "fingerprint": null, "merged_into_incident_id": null, "merged_by": null, "merged_at": null, "enrichments": {}, "incident_type": "rule", "incident_application": "None", "resolve_on": "all_resolved", "rule_id": null, "rule_name": null, "rule_is_deleted": null, "name": "manual-run", "lastReceived": "2025-04-29T08:15:19.851454+00:00", "trigger": "manual" }

[shahargl]

you are using console provider that dumps it as string, that's why foreach iterate it as list of characters. you can use incidents.alerts directly in the foreach

[talboren]

Can you maybe send the workflow itself? we can try to help you by adjusting it.

[shahargl]

he sent it:

workflow: 
  id: d8cbb5be-9f95-419f-af1d-96b4ef711f98 
  name: Incidents description: Incidents 
  disabled: false 
  triggers: 
    - type: manual 
  consts: {} 
  owners: [] 
  services: [] 
  steps: 
    - name: get-incident 
      provider: 
        type: console 
        config: "{{ providers.default-console }}" 
        with: 
          message: "{{ incident.alerts }}"
  actions: 
  - name: console-action 
     foreach: "{{ steps.get-incident.results }}" 
     provider: 
       type: console 
       config: "{{ providers.default-console }}" 
       with: 
         message: "{{ foreach.value }}"

[logicall]

you are using console provider that dumps it as string, that's why foreach iterate it as list of characters. you can use incidents.alerts directly in the foreach

Thank you!
I didn't think to put it in "foreach"
It's all working out now.

[talboren]

you are using console provider that dumps it as string, that's why foreach iterate it as list of characters. you can use incidents.alerts directly in the foreach

Thank you! I didn't think to put it in "foreach" It's all working out now.

Glad to hear :)

[talboren]

Answers in #4642 (reply in thread) and #4642 (reply in thread)