Add support for Alerting with UQL

[Wizzzzzzard]

Hi,

I'm trying to create an alert to tell application users when the certificates related to their application are due to expire. I am able to create an alert with just the certificate details by entering at the certDetails level. However doing this with the backend parser makes it impossible to access the data located a level above as far as I can tell.

Sample API response:

{
  "value": [
    {
      "applicationId": "a1b2c3d4",
      "applicationName": "Application Name",
      "certDetails": [
        {
          "thumbPrint": "1A:2B:3C:4D:5E",
          "owner": "John Smith",
          "daysToExpiry": 495
        },
        {
          "thumbPrint": "1A:2B:3C:4D:5E:6F",
          "owner": "John Doe",
          "daysToExpiry": 123
        },
        {
          "thumbPrint": "1A:2B:3C:4D:5E:6F:7G",
          "owner": "Jane Smith",
          "daysToExpiry": 1145
        }
      ]
    },
    {
      "applicationId": "f5de8gfsd18",
      "applicationName": "Application Name 2",
      "certDetails": [
        {
          "thumbPrint": "1A:2B:3C",
          "owner": "Jane Doe",
          "daysToExpiry": -110
        }
      ]
    }
  ]
}

Currently I am entering using value.certDetails which allows me to see thumbPrint, owner and daysToExpiry for each alert, with my alert criteria being based off the daysToExpiry being below a certain threshold.

applicationId	applicationName	thumbPrint	owner	daysToExpiry
a1b2c3d4	Application Name	1A:2B:3C:4D:5E	John Smith	495
a1b2c3d4	Application Name	1A:2B:3C:4D:5E:6F	John Doe	123
a1b2c3d4	Application Name	1A:2B:3C:4D:5E:6F:7G	Jane Smith	1145
f5de8gfsd18	Application Name 2	1A:2B:3C	Jane Doe	-110

I am also displaying this data in a table using UQL as part of a Certificate dashboard and with UQL I am able to expand each certDetail into it's own row including all the higher level details using the following query:

parse-json
| project "value"
| mv-expand "certDetails"

Is there a way to replicate similar behaviour using only the backend parser? Or failing that adding support to use UQL with Grafana alerting?

[yesoreyeram]

Hiya.. There is no plans to add support for alerting in UQL. BTW, you can achieve the desired behaviour using backend parser and jsonata query as root selector. For example, following root selector will give you the results you want.

$map($.value, function($app){
  $map($app.certDetails, function($cert){
       return {
           "app": $app.applicationName,
           "owner" : $cert.owner,
           "thumbPrint" : $cert.thumbPrint,
           "daysToExpiry" : $cert.daysToExpiry
     }
  })
}).*