A filter has one condition and one action. The condition checks one field, From, To, CC, Subject or Body, against text you supply, using equals, contains, begins with, ends with or matches. The action is either ignore this message or call these phones, with a tickbox per configured number, so one filter can ring several people.
The default number catches everything else. Anything no filter excludes rings your default number. That is the opposite of how most rules engines work: the default is that everything gets through, and filters carve out the exceptions. Numbers that are not the default ring only when a filter ticks them.
Three patterns cover most setups:
- Silence the all-clears. Subject contains RECOVERY, action: ignore. The recovery notices stop ringing anyone; the DOWN and CRITICAL alerts still fall through to the default number.
- Route by site. Subject contains FREEZER-2, action: call the site phone and the manager’s mobile. Put the keyword in the sending tool’s subject line and the routing looks after itself.
- One sender, one person. From contains nagios@, action: call the on-call mobile. Everything from that sender goes to one phone and nothing else does.
Filters also work as a second layer of spam control, since a filter can ignore a sender or a subject you already know to be noise. From the handset, the keypad’s advanced menu can block a sender and create the matching filter for you mid-call.
Each filter is a single condition; there is no and/or logic inside one filter.