Thoughtworks · Client engagement

Costa

Application monitoring and alert delivery

What I built

An application monitoring system with log alerts, team notifications and homepage checks.

My roleDevOps Engineer
Project participationApr – Jun 2019
Core toolsGraylog · Alertmanager · Slack

01 / Monitoring flow

Application logs into team notifications.

I worked as a DevOps Engineer on Costa’s digital transformation project, using AWS, Terraform and monitoring tools including Prometheus, Graylog and Alertmanager.

I developed an application monitoring and alerting system for the team. I connected Graylog log alerts with Alertmanager and Slack, and added scheduled checks of the website’s homepage.

The system gave the team a central place to review current alerts and a way to receive notifications in its everyday collaboration channels. Log context and environment labels helped connect each notification to the application problem behind it.

Monitoring paths

Log-based alerts

  1. Application logsLog events
  2. GraylogStreams & conditions
  3. Notification integrationAPI callback
  4. AlertmanagerAlert handling
  5. SlackTeam notifications

Scheduled website checks

  1. Homepage checksScheduled AutoTest
  2. SlackCheck reports
Log alerts and homepage checks each deliver signals to the team in Slack.

A concrete alert rule

I configured a Graylog stream to select ERROR-level messages. A message-count condition triggered an alert when at least one matching message appeared within a five-minute window. Graylog’s alert configuration included the last message, giving the alert additional context.

A notification callback sent the alert to Alertmanager over HTTP. The integration carried an alert name, environment labels and a Graylog link in its annotations. Alertmanager’s configuration and templates supported delivery to Slack.

02 / Team response

Context and controls for investigation.

I set up separate Slack notification channels for the China and Japan business environments. Alert messages included the environment, alert name and a Graylog link, with distinct firing and resolved states.

Inspect
View the current alert, its trigger time, stream and rule details, then follow the log link to investigate.
Silence
Pause matching notifications by alert name and environment for a defined period while handling an issue.
Resume
Review active silence rules and end a silence early when the team is ready to receive notifications again.

These controls gave the team a practical workflow for receiving an alert, finding the relevant context and managing notifications during investigation.

03 / Homepage checks

A view of the website’s availability.

The AutoTest notifier checked the homepage URL on a schedule and sent reports to Slack. This added a view of the website’s entry point alongside the application’s log-based alerts.

I delivered a system that combined error detection, alert context and team notification, with controls for investigating issues and scheduled checks for observing the website. The team could see both kinds of signal within Slack.