unacknowledge an alert

[ylwu-amzn]

If acknowledge one alert by mistake, user can’t unacknowledge it.

[elfisher]

Hi @bellfrog thanks for the feedback. This is an interesting request. Can you help us understand what circumstances do you want the ability to deacknowledge? Thanks.

[ylwu-amzn]

Suppose we have two team members("A","B") who will process the alert alternately. If "A" acknowledges one alert by mistake, then "B" starts to process the alert, "B" will not receive alert any more, that brings extra effort for "B" to go though all of the acknowledged alerts to confirm if the alert is really completed or just suppressed by acknowledging.

Even for the case when there is only one team member to process the alert, he has to remember which alerts are acknowledged by mistake and process them later. What's more, if he/she just don't want to receive too many alerts today, can the alert just be acknowledged for a period, such as one hour or day?

[elfisher]

@bellfrog thanks for clarifying the use case. It feels like there are 2 things going on here. 1/ fixing an accidental acknowledgement and 2/ reducing the frequency at which the alert comes. We also have a request for adding throttling functionality to notifications to help reduce noise here #14.

[elfisher]

@bellfrog are you thinking of adding an additional route like below or something else?

POST _opendistro/_alerting/monitors/<monitor-id>/_unacknowledge/alerts
{
  "alerts": ["id"]
}

[ylwu-amzn]

@elfisher yes, that's what I want

[elfisher]

I think it's a good idea. @stevensideyliu from a UI perspective, what are your thoughts?

[mihirsoni]

@elfisher I think if we do implement unacknowledged API, then we should have mechanism to have audit trails of acknowledge / unacknowledged.

[piellick]

Very interesting @ylwu-amzn have you find a workaround ? Erase the trigger and recreate it ?

[ylwu-amzn]

Very interesting @ylwu-amzn have you find a workaround ? Erase the trigger and recreate it ?

I think disable and re-enable the monitor may re-trigger alerts.

[qreshi]

Closing in favor of opensearch-project/alerting#30