alert-to-ticket

Alert-to-Ticket Automation

Converts monitoring alerts (text, URL, or structured) into properly formatted Jira tickets. Enriches with context (past incidents, recent deploys), maps severity, and links to runbooks and related tickets.

Usage

/alert-to-ticket [<alert-description>] [--url <url>] [--json <file>] [--service <name>] [--severity <level>] [--dry-run]

• <alert-description>: Paste alert text directly
• --url <url>: Fetch alert from monitoring dashboard
• --json <file>: Parse structured alert JSON
• --service <name>: Override service detection
• --severity <level>: Override auto-detected severity
• --dry-run: Preview ticket without creating

Workflow

Phase 1: Alert Intake & Parsing

Ingests alert data from multiple sources and extracts key information.

class AlertParser {
  constructor() {
    this.alert = {
      service: null,
      metric: null,
      threshold: null,
      currentValue: null,
      timestamp: new Date(),
      environment: "production",
      message: "",
      source: null
    };
  }

  async parseInput(input, url, jsonFile) {
    if (jsonFile) {
      return this.parseJSON(jsonFile);
    }

    if (url) {
      return this.parseFromURL(url);
    }

    if (input) {
      return this.parseText(input);
    }

    throw new Error("No alert input provided");
  }

  parseText(text) {
    // Extract common alert patterns
    const patterns = {
      service: /(?:Service|Alert|Service Name):\s*([^\n,]+)/i,
      metric: /(?:Metric|Condition):\s*([^\n,]+)/i,
      threshold: /(?:Threshold|Trigger|Limit):\s*([\d.]+[a-z%]*)/i,
      currentValue: /(?:Current|Actual|Value):\s*([\d.]+[a-z%]*)/i,
      timestamp: /(?:Time|Occurred|Triggered):\s*([^\n,]+)/i,
      environment: /(?:Environment|Env):\s*([\w-]+)/i
    };

    for (const [key, pattern] of Object.entries(patterns)) {
      const match = text.match(pattern);
      if (match) {
        this.alert[key] = match[1];
      }
    }

    // Fallback: look for common service names
    if (!this.alert.service) {
      const serviceMatch = text.match(/\b(api|web|database|cache|queue|scheduler|worker)\b/i);
      if (serviceMatch) this.alert.service = serviceMatch[1];
    }

    this.alert.message = text;
    this.alert.source = "text";

    return this.alert;
  }

  async parseFromURL(url) {
    try {
      const response = await fetch(url);
      const html = await response.text();

      // Extract alert data from HTML (Datadog, New Relic, etc.)
      const serviceMatch = html.match(
        /<span[^>]*class="[^"]*service[^"]*"[^>]*>([^<]+)<\/span>/i
      );
      const metricMatch = html.match(
        /<span[^>]*class="[^"]*metric[^"]*"[^>]*>([^<]+)<\/span>/i
      );
      const valueMatch = html.match(/(?:Value|Current):\s*([\d.]+)/);

      if (serviceMatch) this.alert.service = serviceMatch[1].trim();
      if (metricMatch) this.alert.metric = metricMatch[1].trim();
      if (valueMatch) this.alert.currentValue = valueMatch[1];

      this.alert.message = html;
      this.alert.source = url;

      console.log(`✓ Parsed alert from URL: ${url}`);
      return this.alert;
    } catch (err) {
      console.error(`ERROR: Failed to fetch alert from URL: ${err.message}`);
      return gracefulFailure("Unable to fetch alert from URL");
    }
  }

  parseJSON(jsonFile) {
    try {
      const data = JSON.parse(fs.readFileSync(jsonFile, "utf-8"));

      // Map common alert JSON structures
      this.alert.service = data.service || data.serviceName || data.source || null;
      this.alert.metric = data.metric || data.check || data.condition || null;
      this.alert.currentValue = data.value || data.currentValue || null;
      this.alert.threshold = data.threshold || data.limit || null;
      this.alert.environment = data.environment || data.env || "production";
      this.alert.timestamp = new Date(data.timestamp || new Date());
      this.alert.message = JSON.stringify(data, null, 2);
      this.alert.source = jsonFile;

      console.log(`✓ Parsed structured alert from ${jsonFile}`);
      return this.alert;
    } catch (err) {
      console.error(`ERROR: Failed to parse JSON alert: ${err.message}`);
      return gracefulFailure("Invalid JSON alert file");
    }
  }

  validate() {
    if (!this.alert.service) {
      throw new Error("Could not determine service from alert; use --service");
    }

    if (!this.alert.metric && !this.alert.message) {
      throw new Error("No metric or message found in alert");
    }

    return true;
  }
}

const parser = new AlertParser();
const alert = await parser.parseInput(
  argv._[0], // positional text arg
  argv.url,
  argv.json
);

parser.validate();

console.log(`✓ Alert parsed`);
console.log(`  Service: ${alert.service}`);
console.log(`  Metric: ${alert.metric || "(not specified)"}`);
console.log(`  Value: ${alert.currentValue || "(not specified)"}`);