Incident and Incident Aggregation Identifiers
When incidents and incident aggregations are created, unique identifiers are generated in a specific format.
Identifier Format
The general format for incident identifiers is: INC-<YYMMDD>-<unique_id>.
The general format for incident aggregation identifiers is: AGG-<YYMMDD>-<unique_id>.
Here, <YYMMDD> represents the creation date in the year-month-day format, and <unique_id> is a numeric counter incremented with each new object.
If an error occurs during identifier generation, a random UUID will be assigned to the object instead of <unique_id>.
Incident Manager Settings for Identifier Generation
The following Incident Manager settings control the generation of identifiers:
| Name | Syntax | Default Value | Description |
|---|---|---|---|
use_incremental_ids | <boolean> | true | When set to true, identifiers follow the format above. When false, random UUIDs are used instead. |
default_incident_suffix | <string> | "" | If not empty, this suffix will be added to all incident and aggregation identifiers. The resulting format will be: INC/AGG-<suffix>-<YYMMDD>-<unique_id>. |
acquire_lock_timeout | <int> | 10 | The wait interval between retry attempts to acquire a lock during identifier generation, in milliseconds. |
lock_expiration_timeout | <int> | 60000 | The maximum time to hold a lock. If this duration is exceeded, the lock is considered expired and can be acquired by other threads. Time is specified in milliseconds. |
You can retrieve the current settings using the following request:
GET _core/im_settings/incident-manager-settings
It is not recommended to modify the acquire_lock_timeout and lock_expiration_timeout settings.
Examples
INC-250417-2017 - The incident was created on April 17, 2025, and has a unique number 2017.
AGG-prod-250417-41 - The aggregation was created on April 17, 2025, with a unique number 41. The default_incident_suffix setting was set to prod.