[🐛 Bug]: Prometheus provider stores alert name as alert id

[vmax]

Describe the bug
Prometheus provider stores string values in id which breaks links in workflows:

To Reproduce
Steps to reproduce the behavior:

1. Configure Prometheus+Alertmanager to send alerts to Keep via webhook API (/backend/alerts/event)
2. Receive some events
3. Build a workflow based on those events
4. Observe 500 when clicking on the alert in "Triggered by":

Expected behavior
Generate usable UUID

Screenshots
included

Additional context

Looks like it happens here:

keep/keep/providers/prometheus_provider/prometheus_provider.py

Line 182 in 3caff53

alert_id = alert.get("id", alert.get("labels", {}).get("alertname"))

[dosubot]

Hi @vmax! I'm Dosu and I’m helping the keep team.

The Prometheus provider currently sets the alert ID using either the id field from the alert or, if that's missing, the alertname from the labels, which can result in non-unique, non-UUID values and breaks workflow links as you've seen. To generate a usable UUID for each alert, you can update the _format_alert method in prometheus_provider.py to use Python's uuid module.

Here's an example of how you could modify the alert ID assignment:

import uuid

# Inside the for alert in alerts: loop
alert_id = alert.get("id") or alert.get("labels", {}).get("alertname")
if not alert_id or not is_valid_uuid(alert_id):
    # Generate a new UUID if alert_id is missing or not a valid UUID
    alert_id = str(uuid.uuid4())

# Helper function to check if a string is a valid UUID
def is_valid_uuid(val):
    try:
        uuid.UUID(str(val))
        return True
    except ValueError:
        return False

This ensures every alert gets a unique, valid UUID as its ID, which should resolve the workflow linking issue. The rest of the alert processing logic can remain unchanged, so this should be a safe drop-in fix.
You can see the current logic in the code here:

keep/keep/providers/prometheus_provider/prometheus_provider.py

Line 182 in 3caff53

alert_id = alert.get("id", alert.get("labels", {}).get("alertname"))

Let me know if you need a more detailed example or have questions about integrating this!

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}   

[talboren]

Describe the bug Prometheus provider stores string values in id which breaks links in workflows:

**To Reproduce** Steps to reproduce the behavior:

1. Configure Prometheus+Alertmanager to send alerts to Keep via webhook API (/backend/alerts/event)
2. Receive some events
3. Build a workflow based on those events
4. Observe 500 when clicking on the alert in "Triggered by":

**Expected behavior** Generate usable UUID

Screenshots included

Additional context

Looks like it happens here:

keep/keep/providers/prometheus_provider/prometheus_provider.py

Line 182 in 3caff53

alert_id = alert.get("id", alert.get("labels", {}).get("alertname"))

A quick question @vmax: are you sending events to /backend/alerts/event or to /backend/alerts/event/prometheus? Our prometheus provider is configured so that it's extracting the id from the payload itself:

alert_id = alert.get("id", alert.get("labels", {}).get("alertname"))

or takes the alertname, if the id is not present the prometheus payload. We can theoretically just dump a newly generated uuid, but Prometheus usually sends it along.

Let me know and I can maybe craft a PR for that

[vmax]

@talboren we're sending to /backend/alerts/event/prometheus — is that correct integration point as Alertmanager webhook?

[talboren]

@talboren we're sending to /backend/alerts/event/prometheus — is that correct integration point as Alertmanager webhook?

Yep, it is @vmax. Can you dump a payload of one of your alerts in here? ("View Alert") in Keep.

[vmax]

@talboren example payload from Keep's feed:

{
  "id": "HostOomKillDetected",
  "name": "HostOomKillDetected",
  "status": "resolved",
  "severity": "warning",
  "lastReceived": "2025-06-16T07:33:40.039Z",
  "firingStartTime": null,
  "firingCounter": 12,
  "environment": "unknown",
  "isFullDuplicate": false,
  "isPartialDuplicate": true,
  "duplicateReason": null,
  "service": "monitoring-prometheus-node-exporter",
  "source": [
    "prometheus"
  ],
  "apiKeyRef": "webhook",
  "message": null,
  "description": "OOM kill detected\n  VALUE = 6\n  LABELS = map[container:node-exporter endpoint:http-metrics instance:10.76.0.29:9100 job:node-exporter namespace:monitoring nodename:gke-tpa-core-prod-k8-tpa-core-prod-kn-f28e4be9-9297 pod:monitoring-prometheus-node-exporter-tbz7p service:monitoring-prometheus-node-exporter]",
  "description_format": null,
  "pushed": true,
  "event_id": "21795dcf-a0f5-4438-b3bd-8cc76277bdef",
  "url": null,
  "imageUrl": null,
  "labels": {
    "alertname": "HostOomKillDetected",
    "cluster": "tpa-core-prod-k8s-gcp",
    "container": "node-exporter",
    "endpoint": "http-metrics",
    "instance": "10.76.0.29:9100",
    "job": "node-exporter",
    "namespace": "monitoring",
    "nodename": "gke-tpa-core-prod-k8-tpa-core-prod-kn-f28e4be9-9297",
    "origin_prometheus": "tpa-core-prod-k8s-gcp",
    "pod": "monitoring-prometheus-node-exporter-tbz7p",
    "prometheus": "monitoring/monitoring-kube-prometheus-prometheus",
    "service": "monitoring-prometheus-node-exporter",
    "severity": "warning"
  },
  "fingerprint": "0d8e1ece97402670029a2a1bf8a532e9581153ccffdad343ccaecd4ffa4fff53",
  "deleted": false,
  "dismissUntil": null,
  "dismissed": false,
  "assignee": null,
  "providerId": null,
  "providerType": "prometheus",
  "note": null,
  "startedAt": "2025-06-15 08:01:10.132000",
  "isNoisy": false,
  "incident": null,
  "alertname": "HostOomKillDetected",
  "generatorURL": "http://monitoring-kube-prometheus-prometheus.monitoring:9090/graph?g0.expr=%28increase%28node_vmstat_oom_kill%5B1m%5D%29+%3E+0%29+%2A+on+%28instance%29+group_left+%28nodename%29+node_uname_info%7Bnodename%3D~%22.%2B%22%7D&g0.tab=1",
  "nodename": "gke-tpa-core-prod-k8-tpa-core-prod-kn-f28e4be9-9297",
  "instance": "10.76.0.29:9100",
  "cluster": "tpa-core-prod-k8s-gcp",
  "prometheus": "monitoring/monitoring-kube-prometheus-prometheus",
  "payload": {
    "startsAt": "2025-06-16T07:28:09.127Z",
    "endsAt": "2025-06-16T07:28:39.127Z",
    "generatorURL": "http://monitoring-kube-prometheus-prometheus.monitoring:9090/graph?g0.expr=%28increase%28node_vmstat_oom_kill%5B1m%5D%29+%3E+0%29+%2A+on+%28instance%29+group_left+%28nodename%29+node_uname_info%7Bnodename%3D~%22.%2B%22%7D&g0.tab=1"
  },
  "job": "node-exporter",
  "endpoint": "http-metrics",
  "origin_prometheus": "tpa-core-prod-k8s-gcp",
  "namespace": "monitoring",
  "alert_hash": "dc71feb810b7f16327da3e46cd902e1906167f1df9b136f5498e5f45f5d6355c",
  "container": "node-exporter",
  "annotations": {
    "summary": "Host OOM kill detected (instance 10.76.0.29:9100)"
  },
  "pod": "monitoring-prometheus-node-exporter-tbz7p",
  "startsAt": "2025-06-16T07:28:09.127Z",
  "endsAt": "2025-06-16T07:28:39.127Z"
}

[DragonBot00]

I've submitted a fix for this in #6219. The PR generates a proper UUID when the alert id field is not a valid UUID (e.g., when Alertmanager sends the alertname string). Would appreciate a review when you get a chance!