added workflow to udpate the language conversion
---------
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: Bhargav <BJP232004@GMAIL.COM>
Design at : red-drill-down-analysis
Traces Page
- Navigate to Traces section
- Run a trace query (standard or SQL mode)
- Click the "Analyze" button in the results toolbar
- Analysis modal opens with three tabs: Rate, Latency, Errors
Logs Page
1. Navigate to Logs section
2. Run a log query (standard mode only - SQL mode does not support
analysis)
3. Click the "Analyze" button in the results toolbar
4. Analysis modal opens with Volume tab (logs only support volume
analysis)
Note: The Analyze button is automatically hidden when in SQL mode on the
logs page.
## Summary
Implements org-level alert deduplication with semantic field groups for
intelligent alert suppression and batched notifications. This feature
prevents alert storms by deduplicating alerts based on configurable
fingerprints and grouping related alerts together.
### Core Capabilities
- **Semantic Field Groups**: Map field name variations (`hostname`,
`host`, `node`) to canonical dimensions for consistent deduplication
across different data sources
- **Organization-Level Configuration**: Global deduplication settings
with cross-alert support to suppress alerts from different rules sharing
semantic dimensions
- **Alert Grouping & Batching**: Wait-and-collect logic with three send
strategies (`FirstWithCount`, `Summary`, `All`) for batched
notifications
- **Per-Alert Control**: Individual alert deduplication settings with
optional fingerprint field customization
### Features
**Deduplication Modes:**
- Per-alert exact matching using fingerprint-based TTL expiration
- Cross-alert semantic matching using org-defined dimension groups
- Configurable time windows (per-alert override or org-level default)
**Alert Grouping:**
- Batch alerts with same fingerprint before sending notifications
- Three strategies: first alert with count, summary with names, or all
details
- Configurable wait time (1-300 seconds) and max batch size (1-100
alerts)
- Background processor runs every 1 second for expired batches
**Semantic Field Groups:**
- Built-in presets for common fields (host, IP address, service)
- Kubernetes resource groups (cluster, namespace, pod, node, container)
- Field normalization support (lowercase + trim)
- Overlap handling with first-defined precedence
### Configuration Types
- `SemanticFieldGroup`: Field name equivalence definitions with
normalization
- `GlobalDeduplicationConfig`: Org-level settings with semantic groups
and cross-alert dedup
- `DeduplicationConfig`: Per-alert fingerprint fields and grouping
options
### API Endpoints
- `GET /{org_id}/alerts/deduplication/config` - Retrieve org-level dedup
config
- `POST /{org_id}/alerts/deduplication/config` - Set org-level dedup
config
- `DELETE /{org_id}/alerts/deduplication/config` - Delete org-level
dedup config
### Implementation Details
- Pure business logic algorithms in enterprise layer (fingerprinting,
matching, calculations)
- OSS service layer orchestrates database operations with enterprise
delegation
- Feature-gated with `#[cfg(feature = "enterprise")]` for
enterprise-only functionality
- Background job architecture for async batch processing
- Storage: Org config in KV DB at `/alert_config/{org_id}/deduplication`
### Architecture
```
Alert Triggered
↓
Query Evaluation
↓
Deduplication Check (fingerprint + TTL)
↓
Grouping Enabled? → Add to Batch → Wait/Collect → Send Grouped
↓ No
Send Individual Notification
```
---------
Co-authored-by: Ashish Kolhe <ashish.j.kolhe@gmail.com>
Co-authored-by: Shrinath Rao <shnath@openobserve.ai>
Added tooltip explaining that history is only available for scheduled
and manually triggered pipelines. Real-time pipelines do not generate
history records.
The alerts history endpoint expects alert_id parameter (KSUID format)
not alert_name. This was causing 404 errors when fetching alert history
in the AlertList component.
the below issues are fixed
#9205#9193#7468 (we now show ellipsis and on hover we will show the tooltip with
all the selected streams
#6248 (to fix this previously whenever we have set the cookie expiry
time as session that means as soon as user closes the chrome window it
will be expired now we are having 365 days expiry time)
# Add Row Template Type Support for Alerts
## Overview
This PR adds support for configurable row template types in alerts,
allowing users to choose between **String** and **JSON** formats for row
templates. This provides flexibility in how alert data is formatted and
sent to destinations.
## Features
### Row Template Type Selection
- Added a new `row_template_type` field to alerts with two options:
- **String**: Traditional string-based templates with variable
interpolation
- **JSON**: Structured JSON templates for programmatic consumption
### Database Layer
- Uses efficient `smallint` (i16) storage: `0` for String, `1` for JSON
- Added migration `m20251118_000001_add_alert_row_template_type` with
backward compatibility (defaults to String)
- Includes support for PostgreSQL, MySQL, and SQLite
### API Layer
- Returns enum string representation (`"String"` or `"Json"`) in API
responses
- Full support in GET, CREATE, and UPDATE alert endpoints
### UI Changes
- Added toggle button in alert creation/editing form to switch between
String and JSON template types
- Dynamic placeholder text based on selected template type
- Persists user's template type selection in the database
## Usage Example
### String Template (Default)
When creating an alert with row template type set to **String**:
```
Template Type: [String] JSON
Row Template: Alert triggered: {alert_name} at {timestamp} Affected user: {user_id} Error count: {error_count}
```
### JSON Template
When creating an alert with row template type set to **JSON**:
```
Template Type: String [JSON]
Row Template: { "alert": "{alert_name}", "timestamp": "{timestamp}", "user": { "id": "{user_id}", "name": "{user_name}" }, "metrics": { "error_count": {error_count}, "severity": "{severity}" } }
```
The JSON template type automatically parses and validates JSON
structure, making it ideal for:
- Webhook integrations that expect JSON payloads
- Structured logging systems
- API endpoints requiring specific JSON schemas
- Downstream systems that need programmatic access to alert data
## Technical Details
### Architecture
- **Database**: Stores as `smallint` (0 or 1) for efficiency
- **Service Layer**: Uses `RowTemplateType` enum throughout application
logic
- **API**: Serializes enum as strings (`"String"`, `"Json"`)
- **Frontend**: TypeScript interface uses string type with toggle UI
component
### Backward Compatibility
- Existing alerts without `row_template_type` default to `String`
- Migration adds column with `DEFAULT 0` ensuring zero downtime
- API handles both old and new alert formats seamlessly
## Testing
- Added unit tests for database migration (PostgreSQL, MySQL, SQLite)
- Tested enum serialization/deserialization
- Verified UI toggle behavior and data persistence
- Confirmed backward compatibility with existing alerts
<img width="1070" height="770" alt="Screenshot 2025-11-19 at 5 46 34 PM"
src="https://github.com/user-attachments/assets/900edb1c-815e-4240-91e2-50a1a582a9b0"
/>
resolves https://github.com/openobserve/o2-enterprise/issues/916
**Issue**: Built-in regex pattern imports failed with 0 successful
imports because `jsonArrayOfObj` computed property referenced a null
`baseImportRef` when the BaseImport component wasn't rendered on the
built-in patterns tab.
**Solution**: Added a local ref `localJsonArrayOfObj` and updated the
computed property to use the local ref for built-in patterns tab and
BaseImport's ref for file/URL tabs, along with fixes for partial import
feedback and validation logic.
1. we have created header component which will seperate out the header
part from mainlayout
2. introduced custom dark logo feature , it will fallback to light mode
logo if dark mode logo is not there
1. This PR updates the favicon and also dynamically based on chrome
theme it will change to dark or light icon
2. some newly added files missed the language keys
This PR fixes the alignment issues
1. rum page getting started section is towards up
2. add alert section is little bit up compare to preview section at the
end of the scroll
3. create email button in add destination when no emails are there is
not synced with new UI
4. when pipeline history has no data then the entire page is having some
scroll
5. dropdowns in sql editor page of add alert fixed as there is some
misalignment
6. report list alignment issue and add report alinment issue (top is not
aligned with the side bar
#9079
1. A view was saved while the histogram was being loaded, which
incorrectly hardcoded the loadingHistogram flag as true in the saved
view data.
2. When this saved view was later loaded, the true value of
loadingHistogram was retrieved.
3. This pre-existing true state bypassed the histogram loading logic and
resulted in an incorrect call to the get page count.
ktx-vaidehi
Bhargav
Sai Nikhil
Ashish Kolhe
Subhra264
Loakesh Indiran
Omkar Kesarkhane
udev
Hengfei Yang
Harsh Mahajan