# Sensu OKs are filtered out

**URL:** <https://discourse.sensu.io/t/sensu-oks-are-filtered-out/686>\
**Category:** Sensu Classic (EOL)\
**Created:** [September 30, 2016, 1:52pm UTC](https://discourse.sensu.io/t/sensu-oks-are-filtered-out/686 "2016-09-30T13:52:03Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![1113](https://avatars.discourse-cdn.com/v4/letter/1/c89c15/32.png) [@1113](https://discourse.sensu.io/u/1113)\
**Post date:** [September 30, 2016, 1:52pm UTC](https://discourse.sensu.io/t/sensu-oks-are-filtered-out/686/1 "2016-09-30T13:52:03Z")

</div>

Hi All,

We use filters by occurrences in order to filter unnecessary alerts. But the problem is that I don’t receive OK messages in this case. My assumption is that ok messages are filteres as well as other by occurrence.  
Here is the example of resolve message from logs:

{“timestamp”:“2016-09-30T11:12:06.381458+0300”,“level”:“info”,“message”:“event was filtered”,“handler”:{“type”:“pipe”,“command”:“handler-slack.rb -j slack\_jenkins”,“channel”:“alerts-sensu”,“severites”:[“unknown”,“warning”,“critical”],“filters”:[“recurrence\_5\_1440”],“name”:“slack\_jenkins\_handler”},“event”:{“client”:{“name”:“node009-jenkins-prod”,“address”:“192.168.81.2”,“subscriptions”:[“common”,“infra”,“infra\_prod”],“keepalive”:{“handlers”:[“slack”],“interval”:60,“refresh”:60},“version”:“0.25.2”,“timestamp”:1475223115},“check”:{“command”:"/etc/sensu/plugins/check-jenkins-job-status.rb -u [http://node009-jenkins-prod:8080](http://node009-jenkins-prod:8080) -j ansible-tests -l jenkins\_api -p /opt/sensu/.sensu\_jenkins\_api",“interval”:60,“handlers”:[“slack\_jenkins\_handler”],“source”:“node009-jenkins-prod”,“subscribers”:[“infra\_prod\_sensu\_masters”],“refresh”:60,“name”:“jenkins\_job\_ansible\_tests”,“issued”:1475223125,“executed”:1475223125,“duration”:0.865,“output”:“JenkinsJobChecker OK: All queried jobs reports success\n”,“status”:0,“type”:“standard”,“origin”:“sensu-server001-prod”,“history”:[“2”,“2”,“2”,“2”,“2”,“2”,“2”,“2”,“2”,“2”,“2”,“2”,“2”,“2”,“2”,“2”,“2”,“2”,“2”,“2”,“0”],“total\_state\_change”:6},“occurrences”:45,“action”:“resolve”,“timestamp”:1475223126,“id”:“3f2d92b3-c4d7-4459-81da-7c5e4c69d6c0”,“last\_state\_change”:1475223126,“last\_ok”:1475223126}}

“recurrence\_5\_1440”: {  
“attributes”: {  
“occurrences”: “eval: value == 5 || value % 1440 == 0”  
}

Is there any workaround to filter unnecessary alerts but still receive OK messages?

Thanks,  
Alexey

---

<div class="post-metadata">

**Author:** ![Alexander\_Skiba](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.sensu.io/alexander_skiba/32/408_2.png) [@Alexander\_Skiba](https://discourse.sensu.io/u/Alexander_Skiba)\
**Post date:** [October 2, 2016, 5:00pm UTC](https://discourse.sensu.io/t/sensu-oks-are-filtered-out/686/2 "2016-10-02T17:00:18Z")

</div>

See [https://sensuapp.org/docs/0.26/reference/checks.html#check-attributes](https://sensuapp.org/docs/0.26/reference/checks.html#check-attributes) section “type”.

> **···**
>
> On Friday, September 30, 2016 at 3:52:03 PM UTC+2, Алексей Максимов wrote:
> 
> > Hi All,
> > 
> > We use filters by occurrences in order to filter unnecessary alerts. But the problem is that I don’t receive OK messages in this case. My assumption is that ok messages are filteres as well as other by occurrence.  
> > Here is the example of resolve message from logs:
> > 
> > {“timestamp”:“2016-09-30T11:12:06.381458+0300”,“level”:“info”,“message”:“event was filtered”,“handler”:{“type”:“pipe”,“command”:“handler-slack.rb -j slack\_jenkins”,“channel”:“alerts-sensu”,“severites”:[“unknown”,“warning”,“critical”],“filters”:[“recurrence\_5\_1440”],“name”:“slack\_jenkins\_handler”},“event”:{“client”:{“name”:“node009-jenkins-prod”,“address”:“192.168.81.2”,“subscriptions”:[“common”,“infra”,“infra\_prod”],“keepalive”:{“handlers”:[“slack”],“interval”:60,“refresh”:60},“version”:“0.25.2”,“timestamp”:1475223115},“check”:{“command”:“/etc/sensu/plugins/check-jenkins-job-status.rb -u [http://node009-jenkins-prod:8080](http://node009-jenkins-prod:8080) -j ansible-tests -l jenkins\_api -p /opt/sensu/.sensu\_jenkins\_api”,“interval”:60,“handlers”:[“slack\_jenkins\_handler”],“source”:“node009-jenkins-prod”,“subscribers”:[“infra\_prod\_sensu\_masters”],“refresh”:60,“name”:“jenkins\_job\_ansible\_tests”,“issued”:1475223125,“executed”:1475223125,“duration”:0.865,“output”:“JenkinsJobChecker OK: All queried jobs reports success\n”,“status”:0,“type”:“standard”,“origin”:“sensu-server001-prod”,“history”:[“2”,“2”,“2”,“2”,“2”,“2”,“2”,“2”,“2”,“2”,“2”,“2”,“2”,“2”,“2”,“2”,“2”,“2”,“2”,“2”,“0”],“total\_state\_change”:6},“occurrences”:45,“action”:“resolve”,“timestamp”:1475223126,“id”:“3f2d92b3-c4d7-4459-81da-7c5e4c69d6c0”,“last\_state\_change”:1475223126,“last\_ok”:1475223126}}
> > 
> > “recurrence\_5\_1440”: {  
> > “attributes”: {  
> > “occurrences”: “eval: value == 5 || value % 1440 == 0”  
> > }
> > 
> > Is there any workaround to filter unnecessary alerts but still receive OK messages?
> > 
> > Thanks,  
> > Alexey

---

<div class="post-metadata">

**Author:** ![1113](https://avatars.discourse-cdn.com/v4/letter/1/c89c15/32.png) [@1113](https://discourse.sensu.io/u/1113)\
**Post date:** [October 13, 2016, 8:41am UTC](https://discourse.sensu.io/t/sensu-oks-are-filtered-out/686/3 "2016-10-13T08:41:38Z")

</div>

Thanks for reply,

I don’t think that this can be solution here. I need to get OK only once when issue is resolved.  
If I set metric type I believe I will get every OK message in slack

> **···**
>
> воскресенье, 2 октября 2016 г., 20:00:20 UTC+3 пользователь Alexander Skiba написал:
> 
> > See [https://sensuapp.org/docs/0.26/reference/checks.html#check-attributes](https://sensuapp.org/docs/0.26/reference/checks.html#check-attributes) section “type”.

---

<div class="post-metadata">

**Author:** ![Oded\_Ben\_Ozer](https://avatars.discourse-cdn.com/v4/letter/o/da6949/32.png) [@Oded\_Ben\_Ozer](https://discourse.sensu.io/u/Oded_Ben_Ozer)\
**Post date:** [October 13, 2016, 11:35am UTC](https://discourse.sensu.io/t/sensu-oks-are-filtered-out/686/4 "2016-10-13T11:35:46Z")

</div>

on resolve event I try to check the occurrences value is equal **or bigger** than the predefined value (in your example occurrences = 45).

“recurrence\_5\_1440”: {

“attributes”: {

```
"occurrences": "eval: value == 5 || value % 1440 == 0 **|| ':::action:::' == 'resolve' && value >= 5**"

```

},

}

But this doesn’t seem to work for me, see “Resolve events are being filtered for an unknown reason” thread.

> **···**
>
> On Thursday, October 13, 2016 at 11:41:38 AM UTC+3, Алексей Максимов wrote:
> 
> > Thanks for reply,
> > 
> > I don’t think that this can be solution here. I need to get OK only once when issue is resolved.  
> > If I set metric type I believe I will get every OK message in slack
> > 
> > воскресенье, 2 октября 2016 г., 20:00:20 UTC+3 пользователь Alexander Skiba написал:
> > 
> > > See [https://sensuapp.org/docs/0.26/reference/checks.html#check-attributes](https://sensuapp.org/docs/0.26/reference/checks.html#check-attributes) section “type”.

---

<div class="post-metadata">

**Author:** ![1113](https://avatars.discourse-cdn.com/v4/letter/1/c89c15/32.png) [@1113](https://discourse.sensu.io/u/1113)\
**Post date:** [October 14, 2016, 12:34pm UTC](https://discourse.sensu.io/t/sensu-oks-are-filtered-out/686/5 "2016-10-14T12:34:37Z")

</div>

Hi! Thanks, I have checked this thread and tried this solution.  
Looks like the value cannot be used in this case because this is not number of “resolve” messages. This is the number of last critical or warning messages even if event already resolved.

For example  
history":[“0”,“0”,“0”,“0”,“0”,“1”,“1”,“2”,“2”,“2”,“2”,“2”,“2”,“2”,“2”,“2”,“2”,“2”,“2”,“2”,“0”],“total\_state\_change”:15},“occurrences”:13,“action”:“resolve”

So I am still unable to find appropriate solution.

> **···**
>
> четверг, 13 октября 2016 г., 14:35:46 UTC+3 пользователь Oded Ben Ozer написал:
> 
> > on resolve event I try to check the occurrences value is equal **or bigger** than the predefined value (in your example occurrences = 45).
> 
> > 
> 
> > 
> 
> > “recurrence\_5\_1440”: {
> 
> > “attributes”: {
> 
> > ```
> > "occurrences": "eval: value == 5 || value % 1440 == 0 **|| ':::action:::' == 'resolve' && value >= 5**"
> > 
> > ```
> 
> > },
> 
> > }
> 
> > 
> 
> > But this doesn’t seem to work for me, see “Resolve events are being filtered for an unknown reason” thread.
> 
> > 
> 
> > 
> 
> > On Thursday, October 13, 2016 at 11:41:38 AM UTC+3, Алексей Максимов wrote:
> > 
> > > Thanks for reply,
> > > 
> > > I don’t think that this can be solution here. I need to get OK only once when issue is resolved.  
> > > If I set metric type I believe I will get every OK message in slack
> > > 
> > > воскресенье, 2 октября 2016 г., 20:00:20 UTC+3 пользователь Alexander Skiba написал:
> > > 
> > > > See [https://sensuapp.org/docs/0.26/reference/checks.html#check-attributes](https://sensuapp.org/docs/0.26/reference/checks.html#check-attributes) section “type”.

---

<div class="post-metadata">

**Author:** ![John\_Fessenden](https://avatars.discourse-cdn.com/v4/letter/j/46a35a/32.png) [@John\_Fessenden](https://discourse.sensu.io/u/John_Fessenden)\
**Post date:** [October 17, 2016, 7:24pm UTC](https://discourse.sensu.io/t/sensu-oks-are-filtered-out/686/6 "2016-10-17T19:24:28Z")

</div>

try using occurrences\_watermark (requires newer sensu)

Note, solution to same problem in the occurrences filter extension: [Updating logic to consider occurrence\_watermark when handling resolve events by cwjohnston · Pull Request #2 · sensu/sensu-extensions-occurrences · GitHub](https://github.com/sensu-extensions/sensu-extensions-occurrences/pull/2/files)

or depending on what you’re doing, just try using the above extension.

> **···**
>
> > On Oct 14, 2016, at 5:34 AM, Алексей Максимов \<neizmirasego@gmail.com\> wrote:
> > 
> > Hi! Thanks, I have checked this thread and tried this solution.  
> > Looks like the value cannot be used in this case because this is not number of "resolve" messages. This is the number of last critical or warning messages even if event already resolved.
> > 
> > For example  
> > history":["0","0","0","0","0","1","1","2","2","2","2","2","2","2","2","2","2","2","2","2","0"],"total\_state\_change":15},"occurrences":13,"action":"resolve"
> > 
> > So I am still unable to find appropriate solution.
> > 
> > четверг, 13 октября 2016 г., 14:35:46 UTC+3 пользователь Oded Ben Ozer написал:  
> > on resolve event I try to check the occurrences value is equal or bigger than the predefined value (in your example occurrences = 45).
> > 
> > "recurrence\_5\_1440": {  
> > &nbsp;&nbsp;"attributes": {  
> > &nbsp;&nbsp;&nbsp;&nbsp;"occurrences": "eval: value == 5 || value % 1440 == 0 || ':::action:::' == 'resolve' && value \>= 5"  
> > },  
> > }
> > 
> > But this doesn't seem to work for me, see "Resolve events are being filtered for an unknown reason" thread.
> > 
> > On Thursday, October 13, 2016 at 11:41:38 AM UTC+3, Алексей Максимов wrote:  
> > Thanks for reply,
> > 
> > I don't think that this can be solution here. I need to get OK only once when issue is resolved.  
> > If I set metric type I believe I will get every OK message in slack
> > 
> > воскресенье, 2 октября 2016 г., 20:00:20 UTC+3 пользователь Alexander Skiba написал:  
> > See [https://sensuapp.org/docs/0.26/reference/checks.html#check-attributes](https://sensuapp.org/docs/0.26/reference/checks.html#check-attributes) section "type".