Introduction to routing and escalation in Grafana IRM

Grafana IRM processes every incoming alert through a consistent lifecycle: an integration receives the payload, routes direct it to the correct responders, grouping decides whether the alert joins an existing alert group, and an escalation chain runs until someone acknowledges or resolves the alert group. This page introduces those concepts so you can make confident configuration choices in the Configure escalation and routing section.

How alerts flow through Grafana IRM

When an alert arrives, IRM evaluates it through a fixed sequence of steps. Each step has its own configuration on the integration that received the alert.

A payload arrives through an integration.
IRM applies the integration’s alert templates to format the payload and produce values like the title, message, and Grouping Id.
IRM evaluates the integration’s routes in order. The first route whose template evaluates to True wins.
IRM evaluates the integration’s grouping configuration. If the Grouping Id matches an open alert group on the same route, the payload joins it. Otherwise, IRM creates a new alert group.
The escalation chain on the matched route runs its steps until someone acknowledges or resolves the alert group.

Core components

Six components shape how an alert is handled. Each one has a dedicated configuration page in the Configure escalation and routing section.

Integrations

Integrations are the entry points for alerts. Each integration has its own routes, grouping configuration, and alert templates tailored to the source system, such as Grafana Alerting, Prometheus, Datadog, or a custom webhook.

For setup, refer to Integrations.

Routes

Routes evaluate incoming alerts against Jinja2 templates or label matchers and direct each alert to a specific escalation chain. Routes are evaluated top to bottom; the first match wins. Every integration has a catch-all default route that handles alerts no other route matches.

For details, refer to Configure routing rules.

Alert grouping

Grouping combines related alerts into a single alert group so responders see one coherent unit of work. The Grouping Id template determines which alerts belong together. Open alert groups (Firing, Acknowledged, Silenced) accept new payloads with a matching Grouping Id; resolved groups don’t.

For details, refer to Configure alert grouping.

Escalation chains

Escalation chains define the sequence of actions IRM takes when an alert group is created. A chain might notify an on-call schedule, wait, escalate to additional responders, declare an incident, or trigger a webhook. Chains are configured globally and can be reused across integrations.

For details, refer to Configure escalation chains.

Alert templates

Alert templates control how alert payloads are transformed for display and behavior. Appearance templates format the title, message, and image for each notification channel. Behavioral templates control grouping, auto-resolution, auto-acknowledgment, and the source link.

For details, refer to Customize alert templates.

Labels

Labels are key-value tags applied to alerts. You can use labels to route alerts, organize alert groups, and carry context into incidents and the Service Center.

For details, refer to Configure labels.

Key principles

Four principles shape how the components interact. Understand these to ensure your configuration works as intended.

Routing happens before grouping. Routes select the escalation chain first; grouping then decides which alert group the payload joins.
Each integration has its own routing and grouping configuration. Settings don’t apply across integrations.
Alerts on different routes never group together. Even when their Grouping Ids match, payloads on different routes always create separate alert groups.
Each payload is treated as an independent event. IRM doesn’t update past payloads; a new payload always re-runs the full lifecycle.