Merge pull request #447 from flashcatcloud/feat/coralogix-doc-fix-test

docs(coralogix): match the current Notification Center and alert wizard

Author: ysyneu

en/on-call/integration/alert-integration/alert-sources/coralogix.mdx

@@ -37,15 +37,17 @@ These steps require Notification Center admin permissions (create connectors, pr
 <Steps>
 <Step title="Create a Generic HTTPS connector">
 
-1. Go to **Integrations → Notification Center → Connectors** and click **+ New connector**
-2. Select **Generic HTTPS** as the destination type and name the connector `Flashduty`
-3. Paste the complete Flashduty integration Push URL into **URL** and keep the other fields at their defaults
+1. In the left navigation, hover over **Integrations**, select **Notification Center**, and open the **Connectors** tab
+2. Under **Add new connector**, click **+** next to **Generic HTTPS** and name the connector `Flashduty`
+3. Paste the complete Flashduty integration Push URL into **URL**, keep the other fields at their defaults, and save the connector
+
+**Send test notification** on the connector sends an empty JSON object `{}`. Flashduty returns success and creates no alert.
 
 </Step>
 
 <Step title="Create an alert preset">
 
-1. Go to **Presets**, open the **Alert** tab, select **Generic HTTPS** as the destination type, and click **+ New preset**
+1. Open the **Presets** tab, switch to **Alerts**, and under **Add new alert preset** click **+** next to **Generic HTTPS**
 2. Paste the following JSON into **Body** and save the preset
 
 ```json
@@ -72,8 +74,8 @@ Keep `grouping_key` and `status`. Flashduty rejects requests without `grouping_k
 
 <Step title="Create a router and add an alert rule">
 
-1. Go to **Routers**, click **+ Create router**, and set a routing label such as `team`
-2. On the router's **Alerts** tab, add a rule with the condition `true` and select both **Triggered** and **Resolved** as notification triggers
+1. Open the **Routers** tab and create a router with a routing label, for example **Team** set to `payments`. Routing label keys can only be **Environment**, **Team**, or **Service**
+2. After saving, open the router's **Alerts** tab (it shows **Cases** by default) and click **New rule**. **Notify for all trigger types** is on by default, so both trigger and recovery notifications are sent. Leave the condition empty to match all alerts
 3. Select the `Flashduty` connector and the alert preset you created as the destination
 
 Use an **Alerts** rule, not a **Cases** rule. Flashduty handles alert grouping and incident management itself, and this integration parses alert notifications only.
@@ -82,16 +84,18 @@ Use an **Alerts** rule, not a **Cases** rule. Flashduty handles alert grouping a
 
 <Step title="Configure the alert definition">
 
-1. Edit or create an alert definition and select **Alerts, Signal-Based** in the notification settings
-2. Add a routing label that matches the router, for example `routing.team: payments`
-3. Turn on **Notify when resolved**. Otherwise, Coralogix does not send recovery notifications
-4. If the alert uses **Group by**, select **Trigger a separate notification for each combination** so that each combination becomes a separate Flashduty alert
+1. Edit or create an alert definition. In the **Response** step, set the notification target to **Alerts** (not **Cases**) and **Notification Method** to **Route via Labels**
+2. Add a routing label that matches the router, for example **Team** set to `payments`, which renders as `routing.team: payments`
+3. Keep **Send a notification when resolved** selected (it is selected by default). Otherwise, Coralogix does not send recovery notifications
+4. If the alert uses **Group by**, select **Separate cases** under **Case settings** so that each combination is notified separately and becomes a separate Flashduty alert. The default **Combined case** puts all combinations into one notification
 
 </Step>
 
 <Step title="Verify the lifecycle">
 
-Let the alert actually trigger and confirm that Flashduty receives an active alert. Then let the condition return to normal and confirm that the original alert recovers. **Send test notification** on a preset or connector uses sample data and only verifies that the push URL is reachable.
+Let the alert actually trigger and confirm that Flashduty receives an active alert. Then let the condition return to normal and confirm that the original alert recovers. For a logs threshold alert with a 5-minute window, the trigger notification arrives about 3 minutes after the logs are written, and the recovery notification about 6 minutes after the logs stop.
+
+**Send test notification** on the preset renders the preset with sample data and creates an Info alert named `[Test Alert] General Example` in Flashduty. This alert never receives a recovery notification, so close it manually in Flashduty.
 
 </Step>
 </Steps>
@@ -101,7 +105,7 @@ Let the alert actually trigger and confirm that Flashduty receives an active ale
 
 Flashduty uses `alert.groupingKey` as the Alert Key. Coralogix defines `groupingKey` as the deduplication key in its alert notification schema, and its official Opsgenie and Jira Service Management setups use `groupingKey` to close the matching alert on `Resolved`.
 
-With **Trigger a separate notification for each combination**, each Group by combination is notified separately with its own `groupingKey`, so each one is a separate Flashduty alert. With **Trigger a single notification**, one notification covers every matching combination, so Flashduty creates one alert and lists each combination's priority and values in the description, one per line.
+With **Separate cases**, each Group by combination is notified separately with its own `groupingKey`, so each one is a separate Flashduty alert. With **Combined case**, one notification covers every matching combination, so Flashduty creates one alert and lists each combination's priority and values in the description, one per line.
 
 Changes to the title, description, priority, or group values do not change the Alert Key.
 
@@ -142,8 +146,8 @@ An alert can have at most 50 labels. Requests that exceed this limit are rejecte
 
 - **Coralogix reports a delivery failure**: Confirm that the connector URL is the complete push URL and includes `integration_key`
 - **Flashduty returns a parameter error**: Confirm that the preset Body matches the template above, renders valid JSON, and that `grouping_key` and `status` are not empty
-- **Alerts do not recover**: Confirm that **Notify when resolved** is on for the alert definition and that the routing rule includes **Resolved**. For alerts created with Terraform or the API, also confirm that `notifyOn` is not `triggered_only`. Resolving an alert manually in Coralogix does not send a notification
-- **Several combinations merge into one alert**: The alert definition uses **Trigger a single notification**. Switch it to **Trigger a separate notification for each combination**
+- **Alerts do not recover**: Confirm that **Send a notification when resolved** is selected on the alert definition and that the routing rule has **Notify for all trigger types** on or includes **Resolved**. For alerts created with Terraform or the API, also confirm that `notifyOn` is not `triggered_only`. Resolving an alert manually in Coralogix does not send a notification
+- **Several combinations merge into one alert**: The alert definition's **Case settings** is **Combined case**. Switch it to **Separate cases**
 - **Using a legacy outbound webhook**: This integration parses the body rendered by a Notification Center preset. Legacy outbound webhook templates with `$` placeholders do not work. Coralogix recommends Notification Center over legacy webhooks
 
 For more information, see the Coralogix documentation: [Alerts as a notification source type](https://coralogix.com/docs/user-guides/alerting/configure-notifications/source-type-schema/), [Generic HTTPS connector](https://coralogix.com/docs/user-guides/notification-center/destination-types/https/connector-config/), and [Routing rules](https://coralogix.com/docs/user-guides/notification-center/routing/define-routing-rule/).

zh/on-call/integration/alert-integration/alert-sources/coralogix.mdx

@@ -37,15 +37,17 @@ keywords: ["告警集成", "Coralogix", "Notification Center", "Generic HTTPS",
 <Steps>
 <Step title="创建 Generic HTTPS 连接器">
 
-1. 进入 **Integrations → Notification Center → Connectors**，点击 **+ New connector**
-2. 目标类型选择 **Generic HTTPS**，名称可填写 `Flashduty`
-3. 将 Flashduty 集成的完整推送地址粘贴到 **URL**，其余字段保持默认
+1. 在左侧导航中将鼠标悬停在 **Integrations** 上，选择 **Notification Center**，打开 **Connectors** 页签
+2. 在 **Add new connector** 中点击 **Generic HTTPS** 右侧的 **+**，名称可填写 `Flashduty`
+3. 将 Flashduty 集成的完整推送地址粘贴到 **URL**，其余字段保持默认，保存连接器
+
+连接器的 **Send test notification** 会发送空的 JSON 对象 `{}`，Flashduty 返回成功但不会生成告警。
 
 </Step>
 
 <Step title="创建告警预设">
 
-1. 进入 **Presets**，打开 **Alert** 页签，目标类型选择 **Generic HTTPS**，点击 **+ New preset**
+1. 打开 **Presets** 页签，切换到 **Alerts**，在 **Add new alert preset** 中点击 **Generic HTTPS** 右侧的 **+**
 2. 把下面的 JSON 粘贴到 **Body**，保存预设
 
 ```json
@@ -72,8 +74,8 @@ keywords: ["告警集成", "Coralogix", "Notification Center", "Generic HTTPS",
 
 <Step title="创建路由器并添加告警规则">
 
-1. 进入 **Routers**，点击 **+ Create router**，设置路由标签，例如 `team`
-2. 在路由器的 **Alerts** 页签添加规则：条件填写 `true`，通知触发类型同时勾选 **Triggered** 和 **Resolved**
+1. 打开 **Routers** 页签创建路由器，设置路由标签，例如 **Team** 为 `payments`。路由标签的键只能是 **Environment**、**Team** 或 **Service**
+2. 保存后在路由器中打开 **Alerts** 页签（默认显示的是 **Cases**），点击 **New rule**。**Notify for all trigger types** 默认开启，会同时发送触发和恢复通知；条件留空表示匹配所有告警
 3. 目标选择刚创建的 `Flashduty` 连接器和告警预设
 
 请使用 **Alerts** 规则，不要使用 **Cases** 规则：Flashduty 自己负责告警分组和故障管理，本集成只解析告警通知。
@@ -82,16 +84,18 @@ keywords: ["告警集成", "Coralogix", "Notification Center", "Generic HTTPS",
 
 <Step title="配置告警定义">
 
-1. 编辑或创建告警定义，在通知设置中选择 **Alerts, Signal-Based**
-2. 添加与路由器匹配的路由标签，例如 `routing.team: payments`
-3. 打开 **Notify when resolved**，否则 Coralogix 不会发送恢复通知
-4. 告警设置了 **Group by** 时，建议选择 **Trigger a separate notification for each combination**，每个分组组合在 Flashduty 中成为一条独立告警
+1. 编辑或创建告警定义，在 **Response** 步骤中将通知对象选为 **Alerts**（不是 **Cases**），**Notification Method** 选择 **Route via Labels**
+2. 添加与路由器匹配的路由标签，例如 **Team** 为 `payments`，渲染后为 `routing.team: payments`
+3. 保持 **Send a notification when resolved** 勾选（默认已勾选），否则 Coralogix 不会发送恢复通知
+4. 告警设置了 **Group by** 时，建议在 **Case settings** 中选择 **Separate cases**，每个分组组合分别发送通知，在 Flashduty 中成为一条独立告警。默认的 **Combined case** 会把所有组合放进同一条通知
 
 </Step>
 
 <Step title="验证生命周期">
 
-让告警真正触发，确认 Flashduty 收到活动告警；再让条件恢复正常，确认原告警恢复。预设和连接器的 **Send test notification** 使用示例数据，只能验证推送地址可达。
+让告警真正触发，确认 Flashduty 收到活动告警；再让条件恢复正常，确认原告警恢复。以 5 分钟窗口的日志阈值告警为例，日志写入后约 3 分钟收到触发通知，停止写入后约 6 分钟收到恢复通知。
+
+预设的 **Send test notification** 使用示例数据渲染预设，会在 Flashduty 生成一条 Info 级别的告警 `[Test Alert] General Example`。这条告警不会收到恢复通知，请在 Flashduty 中手动关闭。
 
 </Step>
 </Steps>
@@ -101,7 +105,7 @@ keywords: ["告警集成", "Coralogix", "Notification Center", "Generic HTTPS",
 
 Flashduty 直接使用 `alert.groupingKey` 作为 Alert Key。Coralogix 在告警通知的字段说明中将 `groupingKey` 定义为去重键，其官方 Opsgenie 和 Jira Service Management 配置也在 `Resolved` 时用 `groupingKey` 关闭对应的告警。
 
-选择 **Trigger a separate notification for each combination** 时，每个 Group by 组合分别发送通知，各自拥有自己的 `groupingKey`，因此在 Flashduty 中是不同的告警。选择 **Trigger a single notification** 时，一次通知汇总所有命中的组合，Flashduty 只生成一条告警，并在描述中逐行列出每个组合的优先级和取值。
+选择 **Separate cases** 时，每个 Group by 组合分别发送通知，各自拥有自己的 `groupingKey`，因此在 Flashduty 中是不同的告警。选择 **Combined case** 时，一次通知汇总所有命中的组合，Flashduty 只生成一条告警，并在描述中逐行列出每个组合的优先级和取值。
 
 标题、描述、优先级和分组取值的变化都不会改变 Alert Key。
 
@@ -142,8 +146,8 @@ Flashduty 根据 `status` 判断触发或恢复，根据 `priority`（`alert.hig
 
 - **Coralogix 显示投递失败**：确认连接器 URL 是完整的推送地址，且包含 `integration_key`
 - **Flashduty 返回参数错误**：确认预设 Body 与上文一致，渲染结果是有效 JSON，`grouping_key` 和 `status` 非空
-- **告警没有恢复**：确认告警定义打开了 **Notify when resolved**，路由规则勾选了 **Resolved**；通过 Terraform 或 API 创建的告警还需确认 `notifyOn` 不是 `triggered_only`。在 Coralogix 中手动解决告警不会发送通知
-- **多个分组合并成一条告警**：告警定义选择了 **Trigger a single notification**，改为 **Trigger a separate notification for each combination**
+- **告警没有恢复**：确认告警定义勾选了 **Send a notification when resolved**，路由规则开启了 **Notify for all trigger types** 或勾选了 **Resolved**；通过 Terraform 或 API 创建的告警还需确认 `notifyOn` 不是 `triggered_only`。在 Coralogix 中手动解决告警不会发送通知
+- **多个分组合并成一条告警**：告警定义的 **Case settings** 是 **Combined case**，改为 **Separate cases**
 - **使用旧版 Outbound Webhook**：本集成解析 Notification Center 预设渲染的请求体，旧版 Outbound Webhook 的 `$` 占位符模板不适用。Coralogix 推荐使用 Notification Center 替代旧版 Webhook
 
 更多信息请参阅 Coralogix 文档 [Alerts as a notification source type](https://coralogix.com/docs/user-guides/alerting/configure-notifications/source-type-schema/)、[Generic HTTPS 连接器](https://coralogix.com/docs/user-guides/notification-center/destination-types/https/connector-config/) 和 [路由规则](https://coralogix.com/docs/user-guides/notification-center/routing/define-routing-rule/)。