Incident and Incident Aggregation Identifiers
When incidents and incident aggregations are created, unique identifiers are generated in a specific format.
Why Configure Identifiers
Incremental identifiers are shorter than random UUID values, so they are more convenient when searching for objects, preparing reports, and discussing incidents. A suffix can additionally identify an environment or another context, such as prod for a production environment.
If sequential numbering is not required, the use_incremental_ids setting allows random UUID values to be used. Lock settings control the concurrent generation of incremental identifiers and usually do not need to be changed.
Identifier Format
The general format for incident identifiers is: INC-<YYMMDD>-<unique_id>.
The general format for incident aggregation identifiers is: AGG-<YYMMDD>-<unique_id>.
Where:
<YYMMDD>is the object creation date in the year-month-day format<unique_id>is a numeric counter incremented when each new object is created
If an error occurs during ID generation, a random UUID is assigned to the object instead of <unique_id>.
Incident Manager Settings for Identifier Generation
The following Incident Manager settings control identifier generation:
| Name | Syntax | Default Value | Description |
|---|---|---|---|
use_incremental_ids | <boolean> | true | When set to true, identifiers use the format described above. When set to false, random UUID values are generated. |
default_incident_suffix | <string> | "" | If the suffix is not empty, it is added to the identifiers of all incidents and incident aggregations. The resulting format is: INC/AGG-<suffix>-<YYMMDD>-<unique_id>. |
acquire_lock_timeout | <int> | 10 | The wait interval between retry attempts to acquire a lock during identifier generation. The value is specified in milliseconds. |
lock_expiration_timeout | <int> | 60000 | The maximum time to hold a lock. When this interval is exceeded, the lock is considered expired and other threads can acquire it. The value is specified in milliseconds. |
You can retrieve the current settings with the following request:
GET _core/im_settings/incident-manager-settings
It is not recommended to change the acquire_lock_timeout and lock_expiration_timeout settings without a specific need.
Changing Settings
To change the settings, run a request in the Dev Tools console (Main Menu - System Settings - Dev Tools). In the request body, specify the settings to change.
To use random UUID values instead of incremental identifiers, run the following request:
PUT _core/im_settings/incident-manager-settings
{
"use_incremental_ids": false
}
To enable incremental identifiers and add the prod suffix, run the following request:
PUT _core/im_settings/incident-manager-settings
{
"use_incremental_ids": true,
"default_incident_suffix": "prod"
}
To remove the suffix, pass an empty string:
PUT _core/im_settings/incident-manager-settings
{
"default_incident_suffix": ""
}
The changed settings are applied when identifiers are generated for new incidents and aggregations. They do not change identifiers of existing objects.
Identifier Examples
INC-250417-2017 — the incident was created on April 17, 2025, and has the unique number 2017.
AGG-prod-250417-41 — the aggregation was created on April 17, 2025, and has the unique number 41. The default_incident_suffix setting was set to prod.