amtool: error: [GET /alerts][400] getAlertsBadRequest matcher value contains unescaped double quote: instance=~".+rem-prod.+" team="OMNR2"

[Evelyn Pereira Souza]

Hi

I get this error with "amtool"

amtool: error: [GET /alerts][400] getAlertsBadRequest matcher value
contains unescaped double quote: instance=~".+rem-prod.+" team="OMNR2"

This the relevant snippet

QUERY_STRING='instance=~".+rem-prod.+" team="OMNR2"'


COUNTER=0
until [[ -z $ALERTS ]]
do
ALERTS=$("${WORKSPACE}"/amtool --tls.insecure.skip.verify
--alertmanager.url="$ENDPOINT" -o extended alert query "$QUERY_STRING" |
grep -w active)
[[ $COUNTER -gt 600 ]] && echo "(..)
done

kind regards
Evelyn

[Brian Candler]

This isn't promQL, although it's similar. It appears that amtool isn't happy with matchers that have two conditions with double quotes:

# /opt/alertmanager/amtool --alertmanager.url="$ENDPOINT" alert query 'foo=~"bar" baz=~"qux"'
amtool: error: [GET /alerts][400] getAlertsBadRequest  matcher value contains unescaped double quote: foo=~"bar" baz=~"qux"

I suggest you try simply removing the double quotes from your amtool query:

QUERY_STRING='instance=~".+rem-prod.+" team="OMNR2"'

=>

QUERY_STRING='instance=~.+rem-prod.+ team=OMNR2'

Ref:

https://manpages.debian.org/testing/prometheus-alertmanager/amtool.1.en.html

https://prometheus.io/docs/alerting/latest/configuration/#matcher

[Evelyn Pereira Souza]

On 06.06.22 19:11, Brian Candler wrote:
> I suggest you try simply removing the double quotes from your amtool query:

Thanks. That solved the issue.

kind regards
Evelyn

[Brian Candler]

I think I see the problem now.  Each query term has to be a separate argument on the command line.

/opt/alertmanager/amtool --alertmanager.url="$ENDPOINT" alert query 'alertname=DiskFull95 alertname=DiskFull95'   # does not work (no results; I think it treats this as alertname="DiskFull95 alertname=DiskFull95")

/opt/alertmanager/amtool --alertmanager.url="$ENDPOINT" alert query 'alertname=DiskFull95' 'alertname=DiskFull95'  # works

Hence this works:

/opt/alertmanager/amtool --alertmanager.url="$ENDPOINT" alert query 'alertname=~"Disk.+"' 'alertname=~".+Full.+"'

Since you put

    amtool ... alert query "$QUERY_STRING"

then the multi-word value is passed as a single argument.

Removing the quotes will allow the shell to split it and pass it as separate arguments:

    amtool ... alert query $QUERY_STRING

Tested:

QUERY_STRING='alertname=~"Disk.+" alertname=~".+Full.+"'

/opt/alertmanager/amtool --alertmanager.url="$ENDPOINT" alert query "$QUERY_STRING"  # does not work (error about unescaped quotes)

/opt/alertmanager/amtool --alertmanager.url="$ENDPOINT" alert query $QUERY_STRING  # works