aiagent/skill/embedded/builtin/query-alert-events/SKILL.md
Query and view alert events on the Nightingale monitoring platform. Supports querying current active alerts (not yet recovered), historical alerts (recovered/not recovered), and retrieving the detailed information of a single alert.
The user must provide:
http://<n9e-host>:<port><username>/<password>If the user has not provided the information above, use the AskUserQuestion tool to ask.
POST /api/n9e/auth/login
Content-Type: application/json
Body: {"username":"<username>","password":"<password>"}
Extract dat.access_token from the response, and include Authorization: Bearer <token> in all subsequent requests.
Determine which query method to use based on the user's intent:
Decision rules:
GET /api/n9e/alert-cur-events/list?<query_params>
Authorization: Bearer <token>
GET /api/n9e/alert-his-events/list?<query_params>
Authorization: Bearer <token>
Active alert details:
GET /api/n9e/alert-cur-event/<event_id>
Authorization: Bearer <token>
Historical alert details:
GET /api/n9e/alert-his-event/<event_id>
Authorization: Bearer <token>
Present the query results to the user in a readable Markdown table or list, including the key information: alert name, severity, trigger time, duration, trigger value, tags, etc.
| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
severity | string | No | All | Alert severity, comma-separated, e.g. "1,2" |
query | string | No | Empty | Search keyword, matches rule name or tags |
stime | int64 | No | No limit | Start time, Unix timestamp (seconds) |
etime | int64 | No | No limit | End time, Unix timestamp (seconds) |
hours | int64 | No | 0 | Last N hours (alternative to stime/etime) |
limit | int | No | 20 | Items per page |
p | int | No | 1 | Page number |
bgid | int64 | No | 0 | Filter by business group ID |
rid | int64 | No | 0 | Filter by alert rule ID |
datasource_ids | string | No | All | Datasource IDs, comma-separated |
prods | string | No | All | Product type, comma-separated, e.g. "metric,host" |
cate | string | No | $all | Datasource category, comma-separated, e.g. "prometheus,host" |
my_groups | bool | No | false | Only show alerts from your own business groups |
event_ids | string | No | Empty | Specific event IDs, comma-separated |
| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
severity | int | No | -1 | Alert severity, single value, -1 means all |
is_recovered | int | No | -1 | Recovery status: 0=not recovered, 1=recovered, -1=all |
query | string | No | Empty | Search keyword, matches rule name or tags |
stime | int64 | No | No limit | Start time, Unix timestamp (seconds) |
etime | int64 | No | No limit | End time, Unix timestamp (seconds) |
hours | int64 | No | 0 | Last N hours (alternative to stime/etime) |
limit | int | No | 20 | Items per page |
p | int | No | 1 | Page number |
bgid | int64 | No | 0 | Filter by business group ID |
rid | int64 | No | 0 | Filter by alert rule ID |
datasource_ids | string | No | All | Datasource IDs, comma-separated |
prods | string | No | All | Product type, comma-separated |
cate | string | No | $all | Datasource category, comma-separated |
| Value | Meaning |
|---|---|
| 1 | Level-1 alert (Critical) |
| 2 | Level-2 alert (Warning) |
| 3 | Level-3 alert (Info) |
There are two ways to specify a time range (choose one):
Method 1: Use the hours parameter (recommended, simpler)
hours=1 → last 1 hourhours=6 → last 6 hourshours=24 → last 24 hourshours=168 → last 7 daysMethod 2: Use the stime + etime parameters (precise control)
stime is passed, etime is automatically set to the current time + 24 hours{
"dat": {
"total": 42,
"list": [<alert event object>, ...]
}
}
{
"id": 12345,
"rule_id": 10,
"rule_name": "CPU usage too high",
"rule_note": "CPU usage exceeded 80% for 5 minutes",
"rule_prod": "metric",
"severity": 1,
"cate": "prometheus",
"cluster": "default",
"datasource_id": 1,
"group_id": 2,
"group_name": "Production environment",
"hash": "rule_10_xxxx",
"target_ident": "web-server-01",
"target_note": "Web server",
"first_trigger_time": 1712000000,
"trigger_time": 1712003600,
"last_eval_time": 1712003600,
"trigger_value": "85.6",
"prom_ql": "cpu_usage_active{ident=\"web-server-01\"}",
"prom_eval_interval": 30,
"prom_for_duration": 300,
"tags": ["ident=web-server-01", "cpu=cpu-total"],
"annotations": {"description": "web-server-01 CPU high"},
"notify_version": 1,
"notify_channels": [],
"notify_groups_obj": [],
"notify_rules": [{"id": 1, "name": "Ops notification"}],
"callbacks": [],
"runbook_url": ""
}
Historical alert events add the following on top of active alerts:
{
"is_recovered": 1,
"recover_time": 1712007200
}
| is_recovered value | Meaning |
|---|---|
| 0 | Not recovered (alert still triggering) |
| 1 | Recovered |
GET /api/n9e/event-tagkeys
Authorization: Bearer <token>
Returns the list of tag keys that can be used for search filtering.
GET /api/n9e/event-tagvalues?key=<tag_key>
Authorization: Bearer <token>
Returns the top 20 most frequent values for the specified tag key.
GET /api/n9e/alert-cur-events-datasources
Authorization: Bearer <token>
GET /api/n9e/busi-groups
Authorization: Bearer <token>
GET /api/n9e/alert-cur-events/list?limit=50
GET /api/n9e/alert-cur-events/list?severity=1&hours=1
GET /api/n9e/alert-cur-events/list?query=CPU&limit=20
GET /api/n9e/alert-his-events/list?hours=24&is_recovered=1&limit=50
GET /api/n9e/alert-cur-events/list?bgid=2&limit=50
GET /api/n9e/alert-cur-events/list?rid=10&limit=50
GET /api/n9e/alert-cur-events/list?severity=1,2&query=web&hours=6&limit=30
GET /api/n9e/alert-cur-event/12345
"1,2"), while historical alerts accept only a single value (e.g. 1)hours or stime/etime to avoid returning too much datalimit and p (page number) parameters for pagination; limit defaults to 20tags in the response is a string array in ["key=value"] formattrigger_time, first_trigger_time, recover_time, last_eval_time, etc.rule_name) and the tags (tags)/alert-cur-event/<id>, historical alerts use /alert-his-event/<id> (note the singular/plural)