I think I may have found the problem but need to run some experiments to verify. I think the issue is as follows:
-
When first entering alerting the rule detects that it’s the first time through
if(record.alertTimer === null && !record.isAlerting)
. So whether or not there is already a timer is one of the criteria to determine if this is the first alert. -
There is no timeout (i.e. wait for some amount of time before calling the alert rule) and there is no reminder period. This causes the timer that sends the alert to run immediately.
-
Looping timer works by return value of the function the timer calls. If it returns something that can be converted to a time, that’s when it schedules the timer function to run again. When it returns
null
the timer exits and cleans up after itself by settingrecord.alertTimer
tonull
. -
When there is no repeatTime property defined the time to reschedule the timer becomes
null
and the timer cleans itself up by settingrecord.alertTimer
tonull
. -
The next time an event comes in that is over the alert value it’s seen as a brand new alert because there’s no timer.
I’ve been tearing my hair out looking at the hysteresis but the problem is the reminder timer. All my instances of this template use the reminder so I aparently never tested it without a reminder.
I need to think about how best to handle this for a bit because the straight forward approach would be a breaking change.
In the mean time you should be able to avoid the problem by setting a rediculous reminder period, like P1WT
(one weekl). That will keep the alert timer around as long as the value remains above the threhold so the rule will see that it has already alerted. At worse, if the value remains above the threshold, you’ll get a reminder once a week.