To set up alerts you must create an alert group. When end-users save a query as an alert, they must select an alert group for their alert.
Note: For incremental alerts, you may also need to change the offset time for the alert. The offset is needed because there is a lag between analysis (the document processing) and saving the documents to the index. For details, see Define timestamp offsets for incremental alerts (Optional).
An alert group allows to gather alerts sharing the same parameters.
A scheduled alert group defines:
• when and how often to check for matching documents, such as daily at 3 pm, or every Monday at noon.
• the security source. To save a query as an alert in the Mashup Builder, the end-user must be logged in.
• how the alert will be published, which can be either as an email, as a web service or using a custom publisher.
1. In the Business Console, go to Notification > Alerting.
2. On the Alert Group List, click Add.
3. In the Add Alert Group dialog box,
a. For Name, type something that is descriptive for end-users such as Daily-email.
b. For Type, select Scheduled.
4. Select Use as default if you want this alert to be the default choice displayed to the user when clicking Save query as alert in the Mashup Builder.
5. Enter a description, for example, daily alerts.
6. For Result mode select:
◦ New and modified documents to retrieve documents matching the query and that have been added or changed since the time the alert ran.
◦ All matching documents to retrieve all matching documents regardless of timestamp.
7. For Recurrence, click Edit and:
◦ Choose to execute the alert monthly, weekly or using a Quartz scheduling.
◦ Specify the execution time and the update frequency. For example, weekly at 08:30:00 on Tuesday and Friday.
8. For Security source, enter the security source name, for example, mysecurity.
◦ This is only required for saving alerts using the Mashup Builder alerting widgets. If building your own, or building a custom application, a security source is optional.
You must now specify how to publish the alert.
Publish scheduled alerts
You can publish scheduled alerts as email, web service or using custom publishers.
Publish the alert as an email
1. Still in the same alert group details, click Add Alert Publisher.
a. Enter a descriptive Name, for example email to user.
b. Select Send by email.
2. Specify the addresses and content:
a. From address: Specify the sender address you want to display in the email.
b. To address: Replace mycompany.com with your company’s domain name. ${USER} is a variable, and will automatically be populated with the end-user’s login name.
c. Feed to render: Specify the Mashup feed to include in the email, by default this is cloudview. You must verify that this is the correct feed. This is the mashup feed that determines which document matches which query.
3. (Optional) Modify the Email Format.
a. Title: Modify the format for the email subject line.
b. Templates directory: Specify a different directory for the template file that defines the message format. The default template directory is <INSTALLDIR>/resource/all-arch/alerting/mail/templates.
c. Template file: Specify a different template filename. Templates are based on FreeMarker.
4. For SMTP Server: Set the properties for outgoing mail transport:
a. Host: SMTP Server host.
b. Port: SMTP Server port.
c. Username: admin user name on the SMTP server.
d. Password: admin password on the SMTP server.
e. Use TLS: Activates Transport Layer Security encryption.
5. Click Go Live.
Publish the alert to a web service
You can publish the alerts to a web service for both real-time and scheduled alerting.
1. Still in the same alert group details, click Add Alert Publisher.
a. Enter a descriptive Name.
b. Select Push to Web service.
2. In Address, specify the URL for the web service.
You can publish alerts using custom publishers for both real-time and scheduled alerting. For more information, see "Custom scheduled publisher" in theExalead CloudView Programmer's Guide.
1. Still in the same alert group details, click Add Alert Publisher.
a. Enter a descriptive Name.
b. Select Custom.
2. In Class id, select your custom publisher.
3. Click Go Live.
Define timestamp offsets for incremental alerts (Optional)
Incremental alerting is based on a document’s analysis timestamp. Since there is a lag between analysis and indexing, there is the chance an alert may run after the analysis of a new batch of documents has started, but before all of these documents have been added to the index.
As a result, there’s a risk that some matching documents will be excluded from both the current alert and the alert that follows.
To prevent this, there is a timestamp offset. The default value is 900s (15 minutes), which you can change. The value needed for the offset depends on typical lag time between analysis and indexing, and the frequency of alerts.
For example, say 10 documents enter the analysis pipeline at 1:00.
Without an offset
• An alert runs at 1:05. It looks for all matching documents in the index with an analysis timestamp between “now” (1:05) and the previous alert.
However, at this time only 4 of the 10 documents from the 1 pm analysis have been saved to the index, so only these 4 documents are included in the alert notification.
• The next time the alert runs at 2:05, it looks for all matching documents in the index with an analysis timestamp that falls between 2:05 and the previous alert from 1:05.
• Even though the 6 remaining documents from the 1:00 analysis are now saved to the index, since their analysis timestamp (1:00) precedes the previous alert (1:05), they are excluded from the 2:05 alert notification.
With an offset
• An alert runs at 1:05. It looks for all matching documents in the index with an analysis timestamp that falls between “now minus 15 min” (12:50) and the previous alert.
By offsetting “now”, none of the 10 documents from the 1:00 analysis are included in the 12:50 alert notification.
• The next time the alert runs at 2:05, it looks for all matching documents in the index with an analysis timestamp between “now minus 15 min” (1:50) and the previous alert (12:50).
• Therefore, all 10 matching documents with a 1:00 analysis timestamp are included in the 2:05 alert notification.
Conversely, if alerts are so frequent that several run between analysis and indexing, an offset that is too large could result in the same documents with the same analysis timestamp being included in multiple alert notifications.
Changing the timestamp offset
The size of this offset depends on how frequently these alerts are scheduled, and how long the lag is between the start of analysis and when the documents are saved to the index. These settings are used by all alert groups.
1. Select Misc > Configuration > Alerting.
2. Under Incremental mode, change the Timestamp offset(s) value.