refactor: deduplication and grouping now only apply when non-null fields are present.

Author: osmontero

plugins/alerts/main.go

@@ -121,14 +121,18 @@ func isDuplicate(alert *plugins.Alert) bool {
 	// Compile regex for array index stripping
 	reArrayIndex := regexp.MustCompile(`\.[0-9]+(\.|$)`)
 
+	var execute bool = false
+
 	for _, d := range alert.DeduplicateBy {
 		d = strings.TrimSuffix(d, ".keyword")
 
 		value := gjson.Get(*alertString, d)
 		if value.Type == gjson.Null {
-			return false
+			continue
 		}
 
+		execute = true
+
 		// Calculate OpenSearch field name by removing array indices
 		searchField := reArrayIndex.ReplaceAllStringFunc(d, func(s string) string {
 			if strings.HasSuffix(s, ".") {
@@ -146,6 +150,10 @@ func isDuplicate(alert *plugins.Alert) bool {
 		}
 	}
 
+	if !execute {
+		return false
+	}
+
 	// Create QueryBuilder and inject the Bool query
 	qb := sdkos.NewQueryBuilder(ctx, indices, "plugin_com.utmstack.alerts")
 	qb.Size(1)
@@ -209,14 +217,18 @@ func getPreviousAlertId(alert *plugins.Alert) *string {
 	// Compile regex for array index stripping
 	reArrayIndex := regexp.MustCompile(`\.[0-9]+(\.|$)`)
 
+	var execute bool = false
+
 	for _, d := range alert.GroupBy {
 		d = strings.TrimSuffix(d, ".keyword")
 
 		value := gjson.Get(*alertString, d)
 		if value.Type == gjson.Null {
-			return nil
+			continue
 		}
 
+		execute = true
+
 		// Calculate OpenSearch field name by removing array indices
 		searchField := reArrayIndex.ReplaceAllStringFunc(d, func(s string) string {
 			if strings.HasSuffix(s, ".") {
@@ -234,6 +246,10 @@ func getPreviousAlertId(alert *plugins.Alert) *string {
 		}
 	}
 
+	if !execute {
+		return nil
+	}
+
 	// Create QueryBuilder and inject the Bool query
 	qb := sdkos.NewQueryBuilder(ctx, indices, "plugin_com.utmstack.alerts")
 	qb.Size(1)