unacknowledge an alert about alerting HOT 10 CLOSED

@elfisher I think if we do implement unacknowledged API, then we should have mechanism to have audit trails of acknowledge / unacknowledged.

from alerting.

I think it's a good idea. @stevensideyliu from a UI perspective, what are your thoughts?

from alerting.

Hi @bellfrog thanks for the feedback. This is an interesting request. Can you help us understand what circumstances do you want the ability to deacknowledge? Thanks.

from alerting.

Suppose we have two team members("A","B") who will process the alert alternately. If "A" acknowledges one alert by mistake, then "B" starts to process the alert, "B" will not receive alert any more, that brings extra effort for "B" to go though all of the acknowledged alerts to confirm if the alert is really completed or just suppressed by acknowledging.

Even for the case when there is only one team member to process the alert, he has to remember which alerts are acknowledged by mistake and process them later. What's more, if he/she just don't want to receive too many alerts today, can the alert just be acknowledged for a period, such as one hour or day?

from alerting.

@bellfrog thanks for clarifying the use case. It feels like there are 2 things going on here. 1/ fixing an accidental acknowledgement and 2/ reducing the frequency at which the alert comes. We also have a request for adding throttling functionality to notifications to help reduce noise here #14.

from alerting.

@bellfrog are you thinking of adding an additional route like below or something else?

POST _opendistro/_alerting/monitors/<monitor-id>/_unacknowledge/alerts
{
  "alerts": ["id"]
}

from alerting.

@elfisher yes, that's what I want

from alerting.

Very interesting @ylwu-amzn have you find a workaround ? Erase the trigger and recreate it ?

from alerting.

Very interesting @ylwu-amzn have you find a workaround ? Erase the trigger and recreate it ?

I think disable and re-enable the monitor may re-trigger alerts.

from alerting.

Closing in favor of opensearch-project/alerting#30

from alerting.