Event Flows: Deep dive into feature
.png)
Managing alert routing in complex environments is hard. When events occur, alerts must reach the right people at the right time, but traditional alert sources struggle with sophisticated, context-aware routing. Event Flows is ilert’s node-based workflow system at the heart of our alerting infrastructure. It enables intelligent event processing, time- and context-based routing, and safe automation, so teams reduce alert fatigue and accelerate incident response.
The pain points Event Flows address
As monitoring footprints grow, standard alerting patterns show limits. Event Flows targets four recurring pain points:
- Complex routing logic. Standard alert sources may route by priority or keywords, but real-world scenarios demand decisions based on event content, custom fields, error patterns, context, and time. Different escalation paths are needed depending on the situation.
- Time-based routing. During support hours, alerts go to the primary on‑call; after hours, they may escalate to a different team or follow a different policy. Without Event Flows, this often requires multiple alert sources or brittle external logic.
- Context-aware decisions. The same signal can have different meanings depending on the context. A database connection error might be critical during peak hours but informational during maintenance windows. Reducing alert noise requires routing that evaluates business context.
- Maintenance overhead. Managing many slightly different alert sources increases operational complexity and the risk of configuration drift. A single, expressive workflow reduces duplication.
Architecture and integration
Event Flows sits between ingestion and alert source routing to deliver smart, reliable processing. It defines how incoming events are processed, transformed, and routed through a configurable sequence of logical components. Let’s take a closer look at the key components that make Event Flows both powerful and adaptable in practice.
Node-based flow builder. A tree-structured builder defines event-processing workflows. Current node types:
- Branch: create scenarios based on conditions.
- Route to alert source: direct events to a specific alert source.
- Support hours: route using predefined support hours.
Queue-based processing. Events arriving via ilert’s event API are first processed by Event Flows, then routed to alert sources. Processing uses AWS SQS FIFO with message groups per API key. This preserves ordering for events from the same alert source and prevents race conditions while keeping near real-time behavior.
Deterministic execution. Each node evaluates conditions and chooses the next step. Execution context is preserved across nodes, enabling decisions that build on prior computations.
Data model. Event Flow contains multiple Event Flow Nodes; each node has Event Flow Branches defining conditions and targets, mirroring the hierarchical execution path.
Powerful automation with ICL (ilert Condition Language)
Event Flows includes a concise expression language inspired by familiar programming patterns. Write conditions that access event data, context, and system state. For more information on ICL, refer to our documentation.
What ICL can see
- Event payload – e.g. event.priority, event.summary, event.source, custom fields
- Time context – business‑hours, weekends, maintenance windows
- Accumulated context – values written by earlier nodes
Examples
Route by priority:
Match text safely:
Time-based routing using support hours:
Combine multiple checks:
Conclusion
Event Flows brings intelligent context-aware routing to ilert’s alerting stack. With a node-based builder and the ilert Condition Language (ICL) for advanced logic, teams can enrich and route events before they become alerts. Strong reliability guarantees ensure less alert noise, fewer misroutes, and faster, more consistent responses.
