How to use keep provider?

[OlegVPA-UA]

Hello,

I'm a little bit confused.
Could you please explain me. How to correctly use keep provider? I want to get feeds from keep by filter, but in any configuration got errors...

[dosubot[bot]]

To use the 'keep' provider correctly, especially when dealing with filters, ensure that you are specifying the filter according to the version of the Keep API you are using. Since you mentioned an error related to a missing filter for version 2, here's what you need to do:

1. Version 2 Filter Syntax: In version 2, the filter should be specified using the filter parameter, not filters. Make sure your workflow step is configured like this:

   - name: keep-step
     provider: keep
     config: "{{ provider.my_provider_name }}"
     filter: "oraId == ORA-01422"

2. Check Workflow Configuration: Ensure that your workflow configuration includes all required parameters for the 'keep' provider, such as provider and config.

3. Verify Version: Double-check that you are indeed using version 2 of the Keep API, as the filter syntax differs from version 1, which uses filters instead of filter ^[1].

By following these steps, you should be able to resolve the error related to the missing filter.

To continue talking to Dosu, mention @dosu.

---

^{Help Dosu learn! Give it feedback: Great Response | Irrelevant Answer | Incorrect Sources | Too Verbose | Hallucination | Bug Report | Other}

[OlegVPA-UA]

With this configuration I got an error: 'str' object has no attribute 'get'

  steps:
    - name: keep-step
      provider:
        type: keep
        config: "{{ providers.default-keep }}"
        with:
          filters: oraId == ORA-01422

[OlegVPA-UA]

Where can I found all syntax for keep-step?

[dosubot[bot]]

The error you're encountering, "'str' object has no attribute 'get'," suggests that there might be a misconfiguration in your YAML structure. In your configuration, the provider should be a string, not a dictionary. Here's how you can correct it:

steps:
  - name: keep-step
    provider: keep
    config: "{{ providers.default-keep }}"
    with:
      filter: "oraId == ORA-01422"  # Use 'filter' for version 2

For detailed documentation and examples of configuring the 'keep' provider in workflows, you can refer to the Keep documentation at https://docs.keephq.dev/providers/documentation/keep-provider. Additionally, you can explore workflow examples in the Keep GitHub repository, such as:

• businesshours.yml
• clickhouse_multiquery.yml
• create_alert_in_keep.yml ^[1].

To continue talking to Dosu, mention @dosu.

---

^{Help Dosu learn! Give it feedback: Great Response | Irrelevant Answer | Incorrect Sources | Too Verbose | Hallucination | Bug Report | Other}

[OlegVPA-UA]

In this sample I see validation error: Value must be "gcpmonitoring" | "trello"

[shahargl]

Hey @OlegVPA-UA,

Good question. We need to shape the documentation for the Keep provider.

The first version of Keep provider used the same "filters system" as the workflow system, mainly you can do something like

filters:
  - key: severity
     value: high
...
more filters

From version 2, Keep provider support CEL directly so you can do something like

steps:
  - name: keep-step
    provider: keep
    config: "{{ providers.default-keep }}"
    with:
      version: 2
      filter: 'oraId == "ORA-01422"'  # any CEL you want

Here's a full working example - https://github.com/keephq/keep/blob/main/examples/workflows/resolve_old_alerts.yml#L15

[shahargl]

You can do something like

  - name: keep-step
    provider: keep
    config: "{{ providers.default-keep }}"
    with:
      version: 2
      filter: 'oraId == "ORA-01422"'  # any CEL you want
      timerange:
        from: "2025-04-01T12:00:00Z"  # Explicit start time
        to: "2025-04-01T13:00:00Z"    # Explicit end time

then, you can use keep functions to generate time (e.g. keep.utcnow()) so you can do smth like

with:
   version: 2
   filter: 'oraId == "ORA-01422"'  # any CEL you want
   timerange:
     from: keep.utcnow()

[OlegVPA-UA]

Ahh... It's not than I want.
I want to get 100 last messages from keep and try to calculate if there was 50 messages for last 5 minutes. But I need to get time for this from startedAt field from feed. I found formula for this:
if: (keep.to_timestamp('{{ foreach.value.startedAt }}') > keep.utcnowtimestamp() - 300)
But still can't understand where I can use it.
I try to play with foreach, but I didn't found documentation how to calculate count after it.

[OlegVPA-UA]

I found just way to use colleration who will create incidents just for oraId and check if incident have alerts_count more than 49 and send message.
It's working but if someone know better way I will be happy if it share with me )

[shahargl]

@OlegVPA-UA how you ended up doing that?

[OlegVPA-UA]

@OlegVPA-UA how you ended up doing that?

1. Created workflow who get everything by message filed filter from Elasticsearch and create alert with every message.
2. Created Extraction who add new field to every alert
3. Created Colleration who create incident by added filter and append to the same Incident if delay between alerts is below 5 minutes
4. Created workflow for create and update incident. For workflow set that:

workflow:
  id: 7c82c1b7-3e47-47a4-90ca-4aab91856a8a
  name: ORA-01422
  description: ORA-01422
  disabled: false
  triggers:
    - type: incident
      events:
        - created
        - updated
  consts: {}
  owners: []
  services: []
  steps:
    - name: get-ora-01422-alerts
      provider:
        type: keep
        with:
          version: 2
          filter: "oraId == 'ORA-01422'"
  actions:
    - name: message-test
      if: "'{{ incident.name }}' == 'ORA-01422' and {{ incident.alerts_count }} > 49"
      provider:
        type: telegram
        config: "{{ providers.telegram }}"
        with:
          chat_id: -000000000
          message: |
            ORA-01422: exact fetch returns more than requested number of rows
            Recived more than 50 times for last 5 minutes.
    - name: resolve-ora-01422-alerts
      foreach: " {{ steps.get-ora-01422-alerts.results }} "
      if: "keep.to_timestamp('{{ foreach.value.lastReceived }}') < keep.utcnowtimestamp() - 3600"
      provider:
        type: mock
        with:
          enrich_alert:
            - key: status
              value: resolved
              disposable: true