The Topology Processor is a core component of Keep that helps correlate alerts based on your infrastructure’s topology, creating meaningful incidents that reflect the relationships between your services and applications. It automatically analyzes incoming alerts and their relationship to your infrastructure topology, creating incidents when multiple related services or components of an application are affected.
Read more about Service Topology.
The Topology Processor is disabled by default. To enable it, set the
environment variable KEEP_TOPOLOGY_PROCESSOR=true
.
Service Discovery: The processor maintains a map of your infrastructure’s topology, including:
Alert Processing: Every few seconds, the processor:
Incident Creation: When multiple services within an application have active alerts:
Variable | Description | Default |
---|---|---|
KEEP_TOPOLOGY_PROCESSOR | Enable/disable the topology processor | false |
KEEP_TOPOLOGY_PROCESSOR_INTERVAL | Interval for processing alerts (in seconds) | 10 |
KEEP_TOPOLOGY_PROCESSOR_LOOK_BACK_WINDOW | Look back window for alert correlation (in minutes) | 15 |
When the processor detects alerts affecting multiple services within an application:
Incidents can be configured to resolve automatically when:
Service Mapping
Application Definition
Alert Configuration
If you have an application “payment-service” consisting of multiple microservices:
When alerts come in for both payment-api
and payment-database
, the Topology Processor will:
The Topology Processor is a core component of Keep that helps correlate alerts based on your infrastructure’s topology, creating meaningful incidents that reflect the relationships between your services and applications. It automatically analyzes incoming alerts and their relationship to your infrastructure topology, creating incidents when multiple related services or components of an application are affected.
Read more about Service Topology.
The Topology Processor is disabled by default. To enable it, set the
environment variable KEEP_TOPOLOGY_PROCESSOR=true
.
Service Discovery: The processor maintains a map of your infrastructure’s topology, including:
Alert Processing: Every few seconds, the processor:
Incident Creation: When multiple services within an application have active alerts:
Variable | Description | Default |
---|---|---|
KEEP_TOPOLOGY_PROCESSOR | Enable/disable the topology processor | false |
KEEP_TOPOLOGY_PROCESSOR_INTERVAL | Interval for processing alerts (in seconds) | 10 |
KEEP_TOPOLOGY_PROCESSOR_LOOK_BACK_WINDOW | Look back window for alert correlation (in minutes) | 15 |
When the processor detects alerts affecting multiple services within an application:
Incidents can be configured to resolve automatically when:
Service Mapping
Application Definition
Alert Configuration
If you have an application “payment-service” consisting of multiple microservices:
When alerts come in for both payment-api
and payment-database
, the Topology Processor will: