KeepHQ Workflow Not Triggering with cel Condition for Incoming Alert

[hopewise]

Hello KeepHQ Community,
I'm trying to set up a workflow that triggers based on the source field of an incoming alert, but it doesn't seem to be working. I'm consistently sending alerts to the /alerts/event endpoint, and they appear in KeepHQ, but the workflow isn't executing.

curl command:

curl --location 'http://0.0.0.0:8080/alerts/event' \
  --header 'Content-Type: application/json' \
  --header 'Accept: application/json' \
  --header 'X-API-KEY: xx-xx-xx-xx \
  --data '{
    "id": "ea945c83-3419-47fd-8e12-52a49e756ec1",
    "name": "Pod 'api-service-production' lacks memory",
    "status": "firing",
    "lastReceived": "2025-06-17T07:51:25.934Z",
    "environment": "production",
    "duplicateReason": null,
    "service": "backend",
    "source": "teams-api-test",
    "message": "The pod 'api-service-production' lacks memory causing high error rate",
    "description": "..Due to the lack of memory, the pod 'api-service-production' is experiencing high error rate",
    "severity": "critical",
    "pushed": true,
    "url": "https://www.keephq.dev?alertId=1234",
    "labels": {
      "pod": "api-service-production",
      "region": "us-east-1",
      "cpu": "88",
      "memory": "100Mi"
    },
    "ticket_url": "https://www.keephq.dev?enrichedTicketId=456",
    "fingerprint": "3698298d-8c03-4b84-b373-94296376141f"
  }'

then I get: {"task_name":"140233708707024"} but the workflow did not get triggered:

workflow:
  id: 0a7c8c2c-7bf5-4762-a057-f05766d9901a
  name: teams
  description: teams
  disabled: false
  triggers:
    - type: alert
      cel: source == 'teams-api-test'
  inputs: []
  consts: {}
  owners: []
  services: []
  steps: []
  actions:
    - name: teams-action
      provider:
        type: teams
        config: "{{ providers.teams-channel }}"
        with:
          message: Hello! This is Keep HQ ===

What I've observed:

If I run the workflow manually it works and I can the see the message in teams channel.

Here is what I can see:

Error parsing event from keep

Timestamp

6/17/2025, 8:49:48 AM
Raw Event Data

{
  "id": "ea945c83-3419-47fd-8e12-52a49e756ec1",
  "name": "Pod api-service-production lacks memory",
  "status": "firing",
  "lastReceived": "2025-06-17T07:51:25.934Z",
  "environment": "production",
  "duplicateReason": null,
  "service": "backend",
  "source": "teams-api-test",
  "message": "The pod api-service-production lacks memory causing high error rate",
  "description": "..Due to the lack of memory, the pod api-service-production is experiencing high error rate",
  "severity": "critical",
  "pushed": true,
  "url": "https://www.keephq.dev?alertId=1234",
  "labels": {
    "pod": "api-service-production",
    "region": "us-east-1",
    "cpu": "88",
    "memory": "100Mi"
  },
  "ticket_url": "https://www.keephq.dev?enrichedTicketId=456",
  "fingerprint": "3698298d-8c03-4b84-b373-94296376141f"
}
Stack Trace

Error processing event, contact Keep team for more information

My question:

Given the above, why might my workflow not be triggering? Are there specific debugging steps or logs I should be looking for within KeepHQ to understand why the cel condition isn't evaluating to true, or if the workflow isn't being considered at all? Any common pitfalls with cel expressions or workflow triggers that I might be missing?

Thank you for your help!

[dosubot[bot]]

Hi @hopewise! I'm Dosu and I’m helping the keep team.

The most likely reason your workflow isn't triggering is a type mismatch in your CEL expression: in some KeepHQ setups, the source field is treated as a list rather than a string. This means that an expression like source == 'teams-api-test' won't match, because it's comparing a list to a string, which CEL doesn't support. Instead, use source.contains("teams-api-test")—this works whether source is a string or a list and should resolve the issue for workflow triggers based on the source field [reference].

Other common pitfalls: mixed quote styles in CEL expressions can cause validation errors in the UI, so stick to either single or double quotes throughout your expression [reference]. Also, make sure your trigger type is alert (not alerts) in your workflow YAML [reference].

For debugging, KeepHQ logs errors when parsing CEL expressions. If you see "Error parsing event from keep" or "Error processing event," check the logs for details—these often point to the exact CEL parsing or evaluation problem [reference].

Try updating your CEL condition to:

cel: source.contains("teams-api-test")

and see if the workflow triggers as expected. If you still see errors, check the logs for parsing or evaluation exceptions—they'll usually indicate if there's a type or syntax issue in your CEL expression.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}   

[hopewise]

I also had to change source in curl to array:

"source": [ "teams-api-test" ]

[talboren]

@hopewise can you try source as a list?:

{
  "id": "ea945c83-3419-47fd-8e12-52a49e756ec1",
  "name": "Pod api-service-production lacks memory",
  "status": "firing",
  "lastReceived": "2025-06-17T07:51:25.934Z",
  "environment": "production",
  "duplicateReason": null,
  "service": "backend",
  "source": ["teams-api-test"],
  "message": "The pod api-service-production lacks memory causing high error rate",
  "description": "..Due to the lack of memory, the pod api-service-production is experiencing high error rate",
  "severity": "critical",
  "pushed": true,
  "url": "https://www.keephq.dev?alertId=1234",
  "labels": {
    "pod": "api-service-production",
    "region": "us-east-1",
    "cpu": "88",
    "memory": "100Mi"
  },
  "ticket_url": "https://www.keephq.dev?enrichedTicketId=456",
  "fingerprint": "3698298d-8c03-4b84-b373-94296376141f"
}

That's how it is expected.