Correlation API Object

Correlation Definition schema

     "name":"US incidents by service"
     "scope":"location in [us-west-1, us-east-1]"
     "fields_to_correlate": {
     "incident_description":" unique(service) issue in unique(location)"


integer (seconds)

The time period for clustering similar alerts into the same incident. The timer starts when the incident is created. When the correlation period ends, Moogsoft correlates alerts into a new incident.

The correlation engine auto-extends an incident's correlation period if it adds alerts near the end of the specified period. See Correlation Time Period.


JSON object

The set of alert fields and tags to consider for correlation, and the similarity required for a match between an alert and an incident. Two alerts are considered correlated if all the fields and tags in the definition meet the specified degree of similarity.

This object specifies field names as strings and similarities (from 0.0 to 1.0) as floats. For example:{"field_1" : 0.9, "field_2" : 0.5}

See Alert field similarity.



You can specify incident descriptions and fields dynamically, based on the alert data in each incident. See Incident description.



The correlation name. Must be unique.



An optional alert filter if you want to apply the correlation to certain alerts only. To define a filter, go to the Alerts table in the UI and do a search using the smart look-ahead feature.



The UUID if you want to fetch, update, or delete a specific correlation definition.