Create incidents automatically from any tool that can send an e-mail. The email integration allows you to parse custom data, set creation rules, and map fields to create detailed, actionable incidents.

Getting started

1. Go to Integrations → Importing data in your Uptime dashboard.
2. Find the E-mail card and click Add.
3. Give your integration a Name and click Save changes.
4. Copy the unique E-mail address. This is the address your external service will send e-mails to.

Configuring the integration

Once you have your e-mail address set up, you can configure how it processes incoming data to create, update, and resolve incidents.

Incident creation rules

Define when an incident should be created. You can set up one or more conditions based on the subject, sender address, and body in your e-mail. If ANY or ALL of the conditions match—depending on your configuration—an incident will be created.

For example, you can create an incident when the subject in the e-mail contains the word New alert.

Data extraction

Map data from the e-mail directly to Better Stack incident fields. This enriches your incidents with contextual information, making it easier to understand and debug issues.

You can extract data for the following fields:

• Title: The main title of the incident.
• Cause: A short description of what triggered the incident.
• Alert ID: A unique identifier for the incdient, which can avoid duplicates.
• Metadata: Any metadata can be extracted from the e-mail.

Extract values by matching text before, after, or between specific texts, or using regular expressions.

Acknowledging and resolving incidents

Configure rules to automatically acknowledge or resolve incidents based on the incoming e-mail.

• Acknowledging incidents: Set conditions to automatically acknowledge an incident. By default, this is set to Never, requiring manual acknowledgment.
• Resolving incidents: Set conditions to automatically resolve an incident. For example, you can auto-resolve if the email subject contains the word (Resolved). By default, this is set to Never, requiring manual resolution.

On-call escalation

Define who gets notified when an incident is created. You can use a simple escalation, use one of your existing escalation policies, or create a new one with specific steps, notification channels, and time-based rules.

Advanced settings

• Recovery period: Set a recovery period to define how long an alert must remain stable before being automatically marked as resolved. The default is Immediate recovery.
• Metadata: Attach custom key-value pairs (for example, datacenter: us-west-1) to incidents. This metadata can be used for advanced filtering or routing rules in your escalation policies.

Need help?

Please let us know at hello@betterstack.com. We're happy to help! 🙏