Question:
I wanted to replace email IDs from all alert rules as few members left the organization from RBL and escalation matrix needs to be upadated.
I can find details from kibana index but I don’t have idea about replacing of email Ids.
Can we do it through index or we need to do any update at Db level?
Answer1:
If you want to remove email IDs from many alerts follow the below steps
- download the alert JSON file using manage_vienna_data.py [~/workspace/Cairo/tools]
- Edit the Alert Json with vim
- Use VIM’s search and replace option to remove the email ID’s For example, if you want to delete manojk@vunetsystems.com from an alert, edit the file with vim and run the below command.
:%s/manojk@vunetsystems.com//g
Note: Don’t forget to remove the ‘,’ as well in case if the email ID is in the middle of the list. :%s/manojk@vunetsystems.com,//g - Save and upload the alerts back to vuSmartMaps using the same script
In the future, to avoid these issues you can use email groups instead of the recipient lists. Steps to configure Email-Groups
- Go to Settings -> Definitions -> Email Groups.
- Add an Email group by clicking the ‘+’ button. Enter details as shown below snapshot.
- Use this Email group in Alerts. And if any of the users leave the organization you can come to this email group and delete the particular email id instead of editing all alerts.
Answer2:
If the requirement is for modifying email Id’s in multiple Json files (say 30+ or 50+ files) then performing search and replace in VIM wouldn’t be ideal. Instead we could try running the below command which would search and replace string over multiple files.
grep -rli ‘old-email’ | xargs sed -i ‘s/old-email/new-email/g’
If the activity is to search and remove a particular email id then as Answer1 pointed out — comma to be removed as well
grep -rli ‘old-email’ | xargs sed -i ‘s/old-email,//g’
But wondering, if we modify these Json files and then re-upload would create any duplicates ?