How To Parse Traefik Router Name From An Alert

by ADMIN 47 views

=====================================================

Introduction

In this article, we will explore how to parse the Traefik router name from an alert using a Go template string. We will assume that you are using a custom HTTP notification channel that feeds alerts as JSON into VictoriaMetrics.

Custom HTTP Notification Channel

The code for the custom HTTP notification channel is provided below:

type: http
name: http_victoriametrics
log_level: info
format: >
  {{- range $Alert := . -}}
  {{- range .Decisions -}}
  {"metric":{"__name__":"cs_lapi_decision","instance":"my-instance","country":"{{$Alert.Source.Cn}}","asname":"{{$Alert.Source.AsName}}","asnumber":"{{$Alert.Source.AsNumber}}","latitude":"{{$Alert.Source.Latitude}}","longitude":"{{$Alert.Source.Longitude}}","iprange":"{{$Alert.Source.Range}}","scenario":"{{.Scenario}}","type":"{{.Type}}","duration":"{{.Duration}}","scope":"{{.Scope}}","ip":"{{.Value}}"},"values": [1],"timestamps":[{{now|unixEpoch}}000]}
  {{- end }}
  {{- end -}}
url: http://victoriametrics:8428/api/v1/import
method: POST
headers:
  Content-Type: application/json
  # if you use vmauth as proxy, please uncomment next line and add your token
  #Authorization: "<SECRET-TOKEN>"

Injecting Meta Key into Alerts

The Traefik logs parser injects a meta key named traefik_router_name into alerts. This can be achieved using the following command:

docker exec -it crowdsec cscli alerts list -o json | jq -r '.[].events[].meta[] | select(.key == "traefik_router_name") | .value'

Parsing the Key using a Go Template String

To parse the key using a Go template string, we need to modify the format field in the custom HTTP notification channel code. We will use the {{.meta.traefik_router_name}} syntax to access the traefik_router_name key.

Here is the modified code:

type: http
name: http_victoriametrics
log_level: info
format: >
  {{- range $Alert := . -}}
  {{- range .Decisions -}}
  {"metric":{"__name__":"cs_lapi_decision","instance":"my-instance","country":"{{$Alert.Source.Cn}}","asname":"{{$Alert.Source.AsName}}","asnumber":"{{$Alert.Source.AsNumber}}","latitude":"{{$Alert.Source.Latitude}}","longitude":"{{$Alert.Source.Longitude}}","iprange":"{{$Alert.Source.Range}}","scenario":"{{.Scenario}}","type":"{{.Type}}","duration":"{{.Duration}}","scope":"{{.Scope}}","ip":"{{.Value}}"},"values": [1],"timestamps":[{{now|unixEpoch}}000],"traefik_router_name": "{{.meta.traefik_router_name}}"}
  {{- end }}
  {{- end -}}
url: http://victoriametrics:8428/api/v1/import
method: POST
headers:
  Content-Type: application/json
  # if you use vmauth as proxy, please next line and add your token
  #Authorization: "<SECRET-TOKEN>"

Accessing the Traefik Router Name

To access the Traefik router name, we can use the following Go template string:

{{.meta.traefik_router_name}}

This will print the value of the traefik_router_name key.

Example Use Case

Here is an example use case where we use the traefik_router_name key to filter alerts:

type: http
name: http_victoriametrics
log_level: info
format: >
  {{- range $Alert := . -}}
  {{- range .Decisions -}}
  {"metric":{"__name__":"cs_lapi_decision","instance":"my-instance","country":"{{$Alert.Source.Cn}}","asname":"{{$Alert.Source.AsName}}","asnumber":"{{$Alert.Source.AsNumber}}","latitude":"{{$Alert.Source.Latitude}}","longitude":"{{$Alert.Source.Longitude}}","iprange":"{{$Alert.Source.Range}}","scenario":"{{.Scenario}}","type":"{{.Type}}","duration":"{{.Duration}}","scope":"{{.Scope}}","ip":"{{.Value}}"},"values": [1],"timestamps":[{{now|unixEpoch}}000],"traefik_router_name": "{{.meta.traefik_router_name}}"}
  {{- if eq .meta.traefik_router_name "router1" }}
  {"alert": "Alert triggered by router1"}
  {{- end }}
  {{- end }}
  {{- end -}}
url: http://victoriametrics:8428/api/v1/import
method: POST
headers:
  Content-Type: application/json
  # if you use vmauth as proxy, please uncomment next line and add your token
  #Authorization: "<SECRET-TOKEN>"

In this example, we use the traefik_router_name key to filter alerts and only trigger an alert if the router name is "router1".

Conclusion

In this article, we explored how to parse the Traefik router name from an alert using a Go template string. We modified the custom HTTP notification channel code to access the traefik_router_name key and provided an example use case where we use the key to filter alerts.

=====================================================

Frequently Asked Questions

Q: What is the Traefik logs parser and how does it inject the traefik_router_name key into alerts?

A: The Traefik logs parser is a tool that parses Traefik logs and injects metadata into alerts. It injects a meta key named traefik_router_name into alerts, which can be accessed using a Go template string.

Q: How do I access the traefik_router_name key using a Go template string?

A: To access the traefik_router_name key using a Go template string, you can use the following syntax: {{.meta.traefik_router_name}}. This will print the value of the traefik_router_name key.

Q: Can I use the traefik_router_name key to filter alerts?

A: Yes, you can use the traefik_router_name key to filter alerts. For example, you can use the following Go template string to filter alerts based on the router name: {{- if eq .meta.traefik_router_name "router1" }}.

Q: How do I modify the custom HTTP notification channel code to access the traefik_router_name key?

A: To modify the custom HTTP notification channel code to access the traefik_router_name key, you need to add the following line to the format field: "traefik_router_name": "{{.meta.traefik_router_name}}". This will add the traefik_router_name key to the alert payload.

Q: Can I use the traefik_router_name key in combination with other metadata to filter alerts?

A: Yes, you can use the traefik_router_name key in combination with other metadata to filter alerts. For example, you can use the following Go template string to filter alerts based on the router name and scenario: {{- if eq .meta.traefik_router_name "router1" and .Scenario == "scenario1" }}.

Q: How do I troubleshoot issues with the traefik_router_name key?

A: To troubleshoot issues with the traefik_router_name key, you can check the following:

  • Make sure that the Traefik logs parser is correctly configured and injecting the traefik_router_name key into alerts.
  • Verify that the custom HTTP notification channel code is correctly accessing the traefik_router_name key.
  • Check the alert payload to ensure that the traefik_router_name key is present and correctly formatted.

Q: Can I use the traefik_router_name key in other contexts, such as in a custom dashboard or alerting system?

A: Yes, you can use the traefik_router_name key in other contexts, such as in a custom dashboard or alerting system. The key can be accessed using a Go template string and can be used to filter or display alerts based on the router name.

Conclusion

In this Q&A article, we covered frequently asked questions about parsing the Traefik router name from an alert using a Go template string. We provided answers to common questions and provided examples of how to use the traefik_router_name key to filter and access metadata.