Triggering pipelines from Grafana alerts

Grafana’s webhook contact point sends the same JSON shape Alertmanager does (status, alerts[], commonLabels, groupKey, externalURL, per-alert fingerprint), so VectorStep’s existing alertmanager source reads it as-is. There is no Grafana-specific source and nothing to configure on the VectorStep side beyond a pipeline.

1. Create the contact point

In Grafana: Alerting → Contact points → Add contact point, integration type Webhook.

Field	Value
URL	https://<your-vectorstep-host>/webhook?source=alertmanager
HTTP method	POST
Authorization header → Scheme	Bearer
Authorization header → Credentials	a token with the webhook role (see Securing a deployment)

Put the token in the Authorization header fields, not in the URL — Grafana stores the URL in plain text and shows it back on read, but masks the credentials fields. Leave Custom Payload empty; the default payload is what the parser expects.

Then route alerts to it with a notification policy (Alerting → Notification policies), matching on whichever labels pick out the alerts you want triaged.

2. Choose how an alert finds its pipeline

Two options, and they combine:

Explicit — a pipeline label on the alert rule. Add the label pipeline = alert-triage to the Grafana rule. VectorStep uses it directly and skips trigger.match.

Matched — trigger.match on labels. Leave the label off and let the pipeline claim alerts by their labels:

trigger:
  match:
    severity: critical         # a label on your Grafana rule
    team: payments

Note that source is alertmanager for Grafana alerts too, so match: { source: alertmanager } can’t distinguish Grafana from a real Alertmanager. Match on a label you control instead. The severity label is whatever you set on the rule — Grafana has no built-in severity, so add one if you want to match or gate on it.

3. Grouping: one run per notification, not per alert

Grafana groups alerts (by default on folder and alert name) and sends one notification per group. VectorStep then picks one representative:

• ?strategy=most_severe (default) — the most severe alert in the group.
• ?strategy=common_labels — treats the group as one event using commonLabels/commonAnnotations, and groupKey for dedup.

If a group routinely contains unrelated alerts, either tighten the notification policy’s Group by so each group is one thing, or use common_labels and let the pipeline see alert_count in metadata.

4. Dedup comes for free

Grafana re-sends firing alerts every repeat interval and sends again on resolve. The Alertmanager source dedups on each alert’s fingerprint plus its status, so repeats are absorbed while a resolve notification is still delivered. See Idempotency & deduplication.

If you don’t want resolve notifications to trigger runs at all, enable Disable resolved message on the contact point.

5. Test it

Use the contact point’s Test button, or send the payload yourself. If the target pipeline is stage: testing, add &allow_testing=true to the URL for the test.

curl -X POST "https://<your-vectorstep-host>/webhook?source=alertmanager&allow_testing=true" \
  -H "Authorization: Bearer $VECTORSTEP_WEBHOOK_TOKEN" \
  -H "Content-Type: application/json" \
  -d @grafana-sample.json

A 202 with "status": "accepted" and a run_id means it landed. Grafana’s Test sends a sample alert with its own labels, so it only reaches a pipeline if a pipeline label or trigger.match accepts them — a 422 No pipeline matched response is the usual result of testing against a pipeline keyed on labels the test alert doesn’t carry.

Using Grafana’s data in a prompt

Labels and annotations are in the context directly; everything else is in metadata:

context_template:
  include:
    - summary
    - labels
    - metadata

metadata carries external_url (your Grafana), starts_at, alert_count, and the group/common labels. Per-alert extras Grafana adds (dashboardURL, panelURL, values) are in raw if a prompt needs them.

Reachability

A Grafana Cloud instance calls out from the public internet, so VectorStep’s port must be reachable from it — see Securing a deployment for what to expose and how. A self-hosted Grafana only needs a network path to VectorStep.