Semantic conventions for alerts

[thompson-tomo]

Area(s)

area:new

Is your change request related to a problem? Please describe.

I want to be able to describe & capture alerts as events in my OPEN Telemetry data just like I can do with ECS and is also described in the CDEvents spec which is also attached.

Describe the solution you'd like

Clear guidance on what the conventions are for describing an alert. Suggestions would be to include:

• rule.category -> A categorization value keyword used by the entity using the rule for detection of this event.

• rule.name -> The name of the rule or signature generating the event.

• rule.description -> The description of the rule generating the event.

• rule.version -> The version / revision of the rule being used for analysis.

• alert.type -> strongly typed option of raise, notify & clear

• alert.message -> user defined message to show in the alert

• alert.severity -> the severity of the alert which is just like log levels

Describe alternatives you've considered

No response

Additional context

https://www.elastic.co/guide/en/ecs/current/ecs-rule.html

https://github.com/cdevents/spec/blob/v0.4.1/continuous-operations.md#ticket