Escalation Grouping

When a system starts having problems, it rarely fires a single alert. A database going down might trigger dozens of alerts within seconds, one for each dependent service, check, or threshold.

Without grouping, each of those alerts would kick off its own escalation chain and wake up your on-call engineer multiple times for what is fundamentally the same incident.

Escalation Grouping solves this by collecting related alerts into a single incident window before the escalation process begins.

Configuring Grouping

To set up grouping for an escalation policy:

1. Navigate to Management > Escalations and open the policy you want to configure.

2. Switch to the Settings tab and find the Grouping section.

3. Click Configure.

The modal that opens lets you choose a grouping mode and set the timing parameters.

Grouping Modes

There are three modes to choose from, depending on how your alert patterns behave.

Disabled

No grouping is applied. Each incoming alert triggers its own escalation independently, without being merged into a shared window. This works well for low-volume, isolated incidents where every alert is expected to be distinct.

Fixed

The grouping window opens when the first alert arrives and runs for a set duration (the Group Interval). Alerts that come in during this window are added to the same incident. New alerts do not extend the window; the timer was set at the start and doesn't move. When it runs out, the group closes and escalation proceeds.

Use Fixed when you know your alert bursts are short-lived and predictable. It gives you a hard boundary on how long alerts are held before someone gets notified.

Sliding

Similar to Fixed, but each new alert resets the countdown. As long as alerts keep coming in, the window keeps sliding forward. The group only closes once there's been a quiet period with no new alerts for the full Group Interval duration.

Use Sliding when your incidents tend to produce waves of alerts with short gaps in between. It keeps everything under one incident until the situation actually settles down.

Window and Timing

Group Interval

Defined in seconds. This is the core timer for both Fixed and Sliding modes:

• In Fixed mode, it's the total duration of the grouping window from the moment the first alert arrives.

• In Sliding mode, it's the quiet period required before the group closes. Each new alert restarts this wait.

Adjust this based on how long your typical alert bursts last.

Upper Limits

Max group duration (Sliding only) sets the hard ceiling on how long a group can stay open in total, in seconds. Without it, a continuous stream of alerts could keep sliding the window indefinitely.

Max Group Size

The maximum number of alerts that can be collected into a single group. Once this count is reached, the group closes immediately with no waiting for the interval to expire. Escalation kicks off right away.

This acts as a safety valve for unusually large incidents where waiting for the timer would delay the response too long.

Choosing the Right Mode

A few practical guidelines:

• If you receive highly critical alerts from your monitoring tool and don't want to wait for any grouping window before getting notified, Disabled is the right choice.

• If you see short bursts of alerts during incidents, Fixed is usually the right call. It's simpler and more predictable.

• If your incidents roll in waves, with alerts firing, pausing, then firing again, Sliding keeps them grouped until things actually calm down.

When in doubt, start with Fixed and adjust the interval based on what you see in practice.