From 46acbef26a306f3e4e416bf78b682e08c660fed1 Mon Sep 17 00:00:00 2001
From: Shahar Glazner <shaharglazner@gmail.com>
Date: Fri, 18 Oct 2024 10:23:48 +0300
Subject: [PATCH] fix(deduplication): allow nested fields in dedup (#2232)

---
 keep/api/tasks/process_event_task.py |  8 +++++---
 keep/providers/base/base_provider.py | 11 +++++++++--
 pyproject.toml                       |  2 +-
 3 files changed, 15 insertions(+), 6 deletions(-)

diff --git a/keep/api/tasks/process_event_task.py b/keep/api/tasks/process_event_task.py
index 7630fbc5a..b7ef5d52f 100644
--- a/keep/api/tasks/process_event_task.py
+++ b/keep/api/tasks/process_event_task.py
@@ -317,7 +317,7 @@ def __handle_formatted_events(
         for key, value in enriched_formatted_event.dict().items():
             if isinstance(value, dict):
                 for nested_key in value.keys():
-                    fields.append(f"{key}_{nested_key}")
+                    fields.append(f"{key}.{nested_key}")
             else:
                 fields.append(key)
 
@@ -326,7 +326,7 @@ def __handle_formatted_events(
             fields=fields,
             provider_id=enriched_formatted_event.providerId,
             provider_type=enriched_formatted_event.providerType,
-            session=session
+            session=session,
         )
 
         logger.debug(
@@ -386,7 +386,9 @@ def __handle_formatted_events(
     # Now we need to run the rules engine
     try:
         rules_engine = RulesEngine(tenant_id=tenant_id)
-        incidents: List[IncidentDto] = rules_engine.run_rules(enriched_formatted_events, session=session)
+        incidents: List[IncidentDto] = rules_engine.run_rules(
+            enriched_formatted_events, session=session
+        )
 
         # TODO: Replace with incidents workflow triggers. Ticket: https://github.com/keephq/keep/issues/1527
         # if new grouped incidents were created, we need to push them to the client
diff --git a/keep/providers/base/base_provider.py b/keep/providers/base/base_provider.py
index 0233b5837..9d2056636 100644
--- a/keep/providers/base/base_provider.py
+++ b/keep/providers/base/base_provider.py
@@ -395,10 +395,17 @@ def get_alert_fingerprint(alert: AlertDto, fingerprint_fields: list = []) -> str
         fingerprint = hashlib.sha256()
         event_dict = alert.dict()
         for fingerprint_field in fingerprint_fields:
-            fingerprint_field_value = event_dict.get(fingerprint_field, None)
+            keys = fingerprint_field.split(".")
+            fingerprint_field_value = event_dict
+            for key in keys:
+                if isinstance(fingerprint_field_value, dict):
+                    fingerprint_field_value = fingerprint_field_value.get(key, None)
+                else:
+                    fingerprint_field_value = None
+                    break
             if isinstance(fingerprint_field_value, (list, dict)):
                 fingerprint_field_value = json.dumps(fingerprint_field_value)
-            if fingerprint_field_value:
+            if fingerprint_field_value is not None:
                 fingerprint.update(str(fingerprint_field_value).encode())
         return fingerprint.hexdigest()
 
diff --git a/pyproject.toml b/pyproject.toml
index 1dfcc6d45..9c678e6cf 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "keep"
-version = "0.26.0"
+version = "0.26.1"
 description = "Alerting. for developers, by developers."
 authors = ["Keep Alerting LTD"]
 readme = "README.md"