Alert Deduplication & Grouping
Regen prevents alert storms from creating hundreds of duplicate incidents. Two mechanisms work together: deduplication (same alert firing again) and grouping (different alerts that belong to the same incident).Deduplication
When an alert arrives, Regen checks if an active alert with the sameexternal_id already exists:
- Match found — Regen updates the existing alert (timestamps, annotations). No new alert or incident is created.
- No match — Regen creates a new alert and evaluates routing rules.
external_id source depends on the integration:
Grouping Rules
Grouping combines multiple related alerts into a single incident. Configure under Settings → Grouping Rules.Example: Group all alerts from the same service
payments-api fires three different alerts within 5 minutes, Regen creates one incident and links all three alerts to it.
How it works
- A new alert arrives
- Regen checks active grouping rules in priority order
- If a rule matches, Regen looks for an open incident that already has alerts matching the same group key
- Match found — the alert is linked to the existing incident (no new incident created)
- No match — evaluated against routing rules to determine whether to create a new incident
Grouping rule fields
Routing Rules
Routing rules control what happens after deduplication and grouping. Configure under Settings → Routing Rules. Rules are evaluated in priority order. The first matching rule wins. Match criteria support exact matching, RE2 regex on label/annotation values, and* wildcards.
→ Full reference: Alert Routing Rules