#!/usr/bin/env python3
# kuma-triage.py < kuma_alerts.json  (episode 16): the same answer as the agent, no model.
# Down now = alert (still_down if it started before the window). 3+ drops in the window = flapping.
# Recovered drops are reported once. Cert < 14 days. Same host + same kind + start within 90 s = one alert.
import json, sys, datetime as dt
d = json.load(sys.stdin); t0 = d["window"]["from"][:19]; out = []
ts = lambda s: dt.datetime.fromisoformat(s.replace("T", " ")[:19])
for m in d["monitors"]:
    if m["type"] == "group" or not m["active"]:
        continue
    downs = [c["t"] for c in m["changes"] if c["status"] == "DOWN"]
    host = m["target"].split("//")[-1].split("/")[0].split(":")[0]
    if m["now"]["status"] == "DOWN":
        out.append(dict(kind="still_down" if m["now"]["since"] < t0 else "outage", start=m["now"]["since"], host=host, monitors=[m["name"]], summary="down since %s: %s" % (m["now"]["since"], m["now"]["msg"][:80])))
    elif len(downs) >= 3:
        out.append(dict(kind="flapping", start=downs[0], host=host, monitors=[m["name"]], summary="%d drops in the window" % len(downs)))
    elif downs:
        out.append(dict(kind="recovered", start=downs[0], host=host, monitors=[m["name"]], summary="was down from %s, up again" % downs[0]))
    if m["tls_days_left"] is not None and m["tls_days_left"] < 14:
        out.append(dict(kind="cert_expiring", start="", host=host, monitors=[m["name"]], summary="certificate expires in %d days" % m["tls_days_left"]))
merged = []
for a in sorted(out, key=lambda a: (a["kind"], a["host"], a["start"])):
    p = merged[-1] if merged else None
    if p and a["kind"] == p["kind"] != "cert_expiring" and a["host"] == p["host"] and abs((ts(a["start"]) - ts(p["start"])).total_seconds()) <= 90:
        p["monitors"] += a["monitors"]
    else:
        merged.append(a)
print(json.dumps({"alerts": [{k: a[k] for k in ("monitors", "kind", "summary")} for a in merged]}, indent=1))