Incident Work History

The history of changes to incidents and aggregation results in Incident Manager is stored in the .sm_im_history index. Each change to an incident or aggregation result is recorded in the index as a separate event.

danger

The user must have permission to write to the .sm_im_history index for their changes to be recorded in the history.

The history is automatically recorded when incidents and aggregation histories are changed via the Incident Manager API, as well as during the operation of the incident aggregation service.

History Structure

Name	Syntax	Description
time	<string>	The time the history record was created.
objectId	<string>	The Meta Id of the object to which this history record belongs.
type	<string>	The type of object to which this history record belongs. Can be aggregation or incident.
user	<string>	The user who made the change.
comment	<string>	The text of the message.
edited	<array>	An object containing information about the change in the value of the incident or aggregation result field. See edited.

danger

A history record cannot contain both the comment and edited fields simultaneously, as each history record should contain only one change.

System Messages

If the user field is empty, it means the event was automatically generated by the system. System messages include the creation of an aggregation result, adding incidents to an aggregation result, closing an aggregation result, and recording in the incident that it has been added to an aggregation result.

Structure of the edited Field

Name	Syntax	Description
fieldName	<string>	The name of the changed field.
oldValue	<keyword>	The old value of the field.
newValue	<keyword>	The new value of the field.

Object Type Field

If the field type is an object, its old and new values should be recorded as a string.

{
  "fieldName": "multiselectField",
  "newValue": """[{"label":"test1","value":"test1"},{"label":"test2","value":"test2"}]""",
  "oldValue": """[{"label":"test1","value":"test1"}]"""
}

Example of a history record when the value of the severity field for an aggregation result is changed by the user admin.

{
  "edited": {
    "fieldName": "severity",
    "newValue": "2",
    "oldValue": "3"
  },
  "objectId": "1O9ZgpABFUl7mow0QwUr",
  "time": "2024-07-05T10:10:52.369Z",
  "type": "aggregation",
  "user": "admin"
}

Example of a system message.

{
  "comment": "Added incidents: 1",
  "objectId": "bCLuOpABaQElF2w4tJD2",
  "time": "2024-06-21T13:28:51.075Z",
  "type": "aggregation"
}

Configuring the Language of System Messages

To change the language of system messages, use the incident_history_language setting stored in the Incident Manager settings. Available languages are Russian (ru) and English (en). The default value is ru.