[Solved] Local expression in Rule does not evaluate as they used to do

[Alan_F]

Resurrecting this older thread... does this answer mean there is no way to react to the presence of an alert within MSR? If not, this would be a useful enhancement.

I have a camera that is switched between day and night settings by http requests sent by MSR near sunset and sunrise. Yesterday the camera stayed in night mode most of the day while there was an alert showing in MSR that the http request had failed. I realize I could capture the http response to an expression/variable and then write a rule based on that variable to notify me, but I'd have to do this for every http request in every ruleset, and I'd have to make sure I evaluate the response correctly (which is likely to be a hit or miss operation for me). That still wouldn't capture other alerts that MSR might display outside of failed http requests, but I'd like to push all alerts to my notification system. Basically, I don't want to have to check the MSR interface to make sure it's happy, I'd like it to tell me when it's not.

[Alan_F]

Just a note for posterity that alerts are now available as an entity as of version 21356.

[cw-kid]

So how do you translate an MSR system generated alert like a HTTP Request faiiing

In to a rules trigger ?

Thanks

[toggledbits]

The reactor_system.alerts attribute value is an array of objects. Each element/object contains keys id, severity, message, timestamp.

Here's an expression that would return an array of messages containing the words "HTTP request" in the message field. You can put this into a local expression of your rule.

each alert in getEntity( 'reactor_system>system' ).attributes.reactor_system.alerts: 
    find( alert.message, "HTTP request", "i" ) >= 0 ? alert : null

If the result of the array has non-zero length, an HTTP error has occurred. You can either just wrap the above expression in len() or use a second local expression (sometimes it's nice to keep them separate so you can more easily see what it's doing).

EDIT: Fixed the match string in find()

[Alan_F]

@toggledbits I was playing with this for about an hour, using it as an exercise to try to get better with arrays and the expression syntax. I created a rule that made a bad http request in order to throw an http request error.

I managed to get to a point where I could concatenate all the alert messages into a single string in an expression. That could then have been used in a rule that checked that expression for 'contains HTTP request'.

The expression you posted above seems like a quicker way to get to the same result, so I tried using it, but it doesn't seem to be working for me.

When I remove the 'find' and just return the alert.messge using:

each alert in getEntity ( 'reactor_system>system' ).attributes.reactor_system.alerts: alert.message

I get:

Last value: (array:1) ["Reaction "Test Rule<SET>" (rule-kxkgh72o:S) step 1 HTTP request failed"]

But your full expression from above returns this:

Last value: (array:0) []

It seems like the 'find' part of the expression isn't matching.

However if I create the following expressions:

g_array_alert_messages = each alert in getEntity ( 'reactor_system>system' ).attributes.reactor_system.alerts: alert.message

and

g_str_alert_messages = join (g_array_alert_messages, " | ")

I get a pipe separated string of all the alert messages that I could use in a rule.

p.s. I also learned that if you point an expression at the alerts, and then use bad syntax in that expression, you can easily create a loop and raise the repeat alert counter to 50,000+ pretty quickly. Thank goodness for the throttling limits, since I also have a rule that sends a notification to my phone whenever an alert is raised and that only fired once per minutes, not 10,000 per minute.

[toggledbits]

Whoops, sorry, the find() is trying to match at the beginning of the string, just remove the ^ from the find match string. I fixed it in that post and tagged the edit.

[cw-kid]

@toggledbits said in Notifications from Alerts:

EDIT: Fixed the match string in find()

That works now, it lists the latest alert error for "HTTP Request"

If there are also other alerts errors still listed in that area of the GUI for "HTTP Request Failed" how would you also get those as well in to an expression value ?

Also is there a way to clear / delete a particular error alert via a rule / code ?

Thanks

[toggledbits]

@cw-kid said in Notifications from Alerts:

If there are also other alerts errors still listed in that area of the GUI for "HTTP Request Failed" how would you also get those as well in to an expression value ?

You're already doing it. The each produces an array of all matching values. The result you are showing is just an array of 1 element because there is only 1 match.

[cw-kid]

This post is deleted!

[cw-kid]

@toggledbits

Sorry I didn't see that there were two ID's listed in that expressions output. So you are right it does appear to be showing both alerts that contain the words "Http request".

[cw-kid]

Trigger:

Not sure if this is the best trigger to use?

Local Expression:

Action:

Send a Telegram notification with the contents of the local expression value / text.

However in Telegram I just get this:

[toggledbits]

First, it will never be null, so that's not a valid test (I mentioned that here).

For your message text, you probably need to convert it from an array to a formatted string that is actually readable. This has been covered a bunch as well (even in this very thread), so I won't give away an answer... better to practice!

[cw-kid]

@toggledbits said in Notifications from Alerts:

it will never be null

Maybe I can use Variable value "is not empty" instead? As the trigger.

I also tried using a Join expression to get some formatted text out of it but I still just get this:

[Alan_F]

@cw-kid

Here's what I have... I want to be notified on all alerts, and I only want to include the message from the most recent alert in the notification. I also needed to remove the escaped quotes (") from the message string because it was messing with my notification where I was inserting the expression into the http call.

So:

g_alerts_array = get all the alerts

g_last_alert = get only the alert where the timestamp == alert_last timestamp

g_last_alert_replaced = remove the " from the alert message string

I realize there is probably some way to combine all of these into one expression, but I was getting errors when I tried wrapping the "first" and "replace" functions around the alerts array expression.

Then in my rule:

If you only want http errors, then you'll have to modify the above expressions to find only those, as Patrick showed above. You'd also have to use a different trigger, as you don't want to fire the event every time the alert_last changes, as some of those won't be http errors.

[toggledbits]

@cw-kid said in Notifications from Alerts:

I also tried using a Join expression to get some formatted text out of it but I still just get this:

The reason your join() doesn't work as expected is that the array contains objects, not strings. @Alan_F gives an option, but he uses first so only one alert, not in array, would result.

Good efforts all around though. Let's fill in some details...

When writing complex expressions, and particularly as you're learning the expression language, it's often better to break it down into pieces as @Alan_F has done. For what you seem to want to do, you started with filtering the array:

Alerts_HTTP_Failed = each alert in getEntity( 'reactor_system>system' ).attributes.reactor_system.alerts: 
    find( alert.message, "HTTP request", "i" ) >= 0 ? alert : null

This gives you an array of objects (as we've established) of only the HTTP request errors. From there, you want to get to just the message strings, but all of them, not just one/the first, so you'll use each again:

HTTP_Fail_Messages = each alert in Alerts_HTTP_Failed: alert.message

That simple expression loops over the objects in the array and extracts just the message field. The result of that is a new array of strings, rather than an array of objects. From there, join...

HTTP_Messages_String = join( HTTP_Fail_Messages, "; " )

And as they say, Robert is your mother's brother.

Doing it all together:

join( each alert in getEntity( 'reactor_system>system' ).attributes.reactor_system.alerts:
    find( alert.message, "HTTP request", "i" ) >= 0 ? alert.message : null, "; " )

If it looks like I left out a step, I did, in a way... rather than having the filter loop return objects, this version just returns the message (strings) directly as an array, so it eliminates that middleman and can then be passed directly into join().

@alan_f said in Notifications from Alerts:

g_last_alert_replaced = remove the " from the alert message string

Although the quotes look funny in the display, I don't think they will bother anything in use, as the notifiers are built to digest/handle such special characters properly.

[Alan_F]

@toggledbits I'm using a self-hosted notification system (Gotify) so when I said 'send notification' it would have been more precise to say "use as the JSON content in an http post request". The " definitely broke the request when it was substituted in to the middle of the request body. I also tried to urlencode the string but while that didn't break the request, it was super ugly as it passed all the encoded characters into the displayed message. I'm not very proficient at regex, so it took an online regex tester and a bit of trial and error to arrive at the right number of backslashes to finally make it work.

Another lesson learned: turn off 'auto evaluate expression' when trying to write expressions that refer to the alerts, 'cause if you get the expression wrong and throw an alert that causes the expression to reevaluate which throws an alert... I had to restart my Reactor Docker container a few times before I turned off 'auto evaluate' ¯_(ツ)_/¯

[toggledbits]

@alan_f said in Notifications from Alerts:

it would have been more precise to say "use as the JSON content in an http post request". The " definitely broke the request when it was substituted in to the middle of the request body.

That would depend on how you are building it. If you are just jamming it in as a string, that's definitely going to create problems. A better approach may be to build the payload as an actual object in the expressions, and then at the end, right before sending to Gotify, put it through the stringify() function, which will convert the object to a JSON string, and that will also handle the quotes correctly to produce valid JSON with the quotes embedded. That will spare you the agony of having to sanitize every string you might ever send.

[cw-kid]

@toggledbits

Thanks I think its working now, here is what I have in the rule:

Trigger: Still not sure if I am using the best or correct trigger?

Local Expressions:

Action:

Send text message to Telegram app:

And this is what I now see on my phone in Telegram:

Thanks

[cw-kid]

I am seeing this alert sometimes to do with this rule

Rule "Alerts - HTTP Request Failed" is being throttled because its update rate exceeds 60 updates per minute. Check for logic errors that may be causing an evaluation loop, or devices that are "flapping".

[RogerO]

Patrick, is there anyway to fire a reaction based on what you are reporting in your status - current alerts?