Turn an alert storm into the few incidents that actually matter — dedupe, correlate, rank, and (optionally) AI-explain alerts from any source, then push a clean digest to Slack.
It's 2 a.m., you're on-call, and 214 alerts are firing. Your real question isn't "what fired?" — it's "what's actually broken, and where do I start?" Studies show 40–60% of alerts never even get investigated because the signal drowns in noise.
alertsift does that triage for you, in one command:
🔔 214 alert(s) → 3 incident(s) (deduped to 60, suppressed 22)
● checkout-svc (critical, 47 alerts) ← start here
types: HighLatency, High5xxRate, PodRestart
checkout-svc is crash-looping and timing out payment calls.
likely cause: a bad deploy or failing dependency in checkout-svc.
● node-7 (medium, 1 alerts)
types: DiskUsage
Source-agnostic by design. It normalizes alerts from Prometheus/Alertmanager, generic JSON, or plain logs into one shape, then dedupes, groups related alerts into incidents, ranks them, and (optionally) has an LLM explain the likely root cause. Adding a new platform (Datadog, CloudWatch, PagerDuty…) is just one new parser.
| Raw alert channel | alertsift | |
|---|---|---|
| Collapses duplicate alerts | ❌ | ✅ |
| Groups related alerts into incidents | ❌ | ✅ |
| Ranks "what to look at first" | ❌ | ✅ |
| Suppresses known noise | ❌ | ✅ .alertsiftignore |
| Plain-English likely cause | ❌ | ✅ (optional LLM) |
| Works with no API key | — | ✅ --no-ai / mock / local Ollama |
| Posts a clean digest to Slack | ❌ | ✅ |
git clone https://github.com/jay-tank/alertsift.git
cd alertsift
pip install .
# optional LLM providers:
pip install '.[claude]' # or '.[openai]'# Triage a file (auto-detects Alertmanager / JSON / logs)
alertsift alerts.json
# From a pipe — e.g. Alertmanager, kubectl, a log tail
amtool alert -o json | alertsift --stdin
# Pure/offline — no LLM, no key (dedupe + correlate + rank only)
alertsift alerts.json --no-ai
# Post a digest to Slack (webhook from env; preview first with --dry-run)
export ALERTSIFT_SLACK_WEBHOOK="https://hooks.slack.com/services/..."
alertsift alerts.json --slack --dry-run # preview the payload
alertsift alerts.json --slack # actually post
# Machine-readable
alertsift alerts.json --jsonExit codes: 0 = nothing actionable, 1 = actionable incident(s) found, 2 =
usage/parse error — so it slots into cron or CI (only pages you when it matters).
INPUT ──► parse (pluggable) ──► normalize ──► dedupe ──► suppress ──►
correlate ──► rank ──► [AI enrich] ──► render / --json / Slack
Steps up to rank are pure and fully offline; the LLM only writes the
plain-English explanation (and is skippable with --no-ai). See
docs/USAGE.md and docs/PROVIDERS.md.
- Secrets never leave your machine. Alert summaries are run through best-effort redaction before being sent to an LLM or posted to Slack.
- Read-only. alertsift never mutates your systems; it reads alerts and reports.
- Slack webhook comes from the environment (
$ALERTSIFT_SLACK_WEBHOOK), never a flag literal, never logged.
Prometheus/Alertmanager, generic JSON, and plain logs today. The core is source-agnostic — Datadog, CloudWatch, and PagerDuty are drop-in parsers on the roadmap.
- Correlation in v1 is heuristic (groups by service/namespace) — solid and explainable, but not a full dependency-graph. Treat "likely cause" as an assist to your judgment, not gospel.
- Log parsing is best-effort.
MIT — see LICENSE.