Final lab: Retention, VRL function and webhook alert

What you will learn in this TP

• Set retention and indexes
• Write a VRL function
• Receive an alert

Introduction #

What you will learn in this section

• Set retention and indexes
• Write a VRL function
• Receive an alert

Context. Your prototype must become usable: keep logs 30 days, optimize searches and notify the team as soon as a payment fails.

Prerequisites: the first lab  ·  Estimated time: 45 min

A complete alert chain.

Setup #

Guided steps, with their solution.

1. 1. Prepare the stack

   Why? The receiver is a neighbouring container, so a private address: without this option OpenObserve refuses the destination. Do not reproduce in production.

   Add an echo container and the ZO_SKIP_SSRF_CHECKS option, then ingest the events of the first lab again.

2. 2. Tune the stream

   Why? These settings decide cost and speed.

   Set 30 days of retention, full text on message, an index on service and a partition on level.

3. 3. Write a function

   Why? VRL transforms events without touching the application.

   Create the marque_grave function, then open it in the Functions menu and test it on an event.

4. 4. Create the alert chain

   Why? The alert needs the destination, which needs the template: order matters.

   Create the template, the destination, then the alert.

5. 5. Trigger the alert

   Why? An alert never fired is an untested alert.

   Send errors and read the logs of the echo container. Allow one to two minutes.

Difficulty level : ●●●○○ (3/5)