Labels in Grafana IRM

Labels help you categorize, route, and manage alert groups and incidents in Grafana IRM. By applying labels, you can optimize response workflows, improve alert routing, and gain visibility into service relationships.

Labels are created and managed centrally in Label management. IRM uses those shared labels to organize alert groups, categorize incidents, and connect services.

How labels work in IRM

Labels are key-value pairs (for example, service_name:payments or severity:critical) that you configure on integrations or add manually to alert groups and incidents. They are essential for alert routing, escalation, and service organization.

You can use labels to:

Organize and filter: Group and filter alert groups based on shared characteristics such as service, severity, or environment.
Route alert groups: Automatically direct alerts to the appropriate escalation chains or individuals based on their labels.
Categorize incidents: Apply labels to incidents to track trends, analyze patterns, and improve your response process.
Automate responses: Trigger actions through custom webhooks based on label criteria.
Manage dependencies: Define service relationships using labels to track dependencies.

Integration labels

You configure labels per integration in the Label Schema section of Integration settings. IRM supports two types of integration labels:

Static labels: Applied to the entire integration and added to all alerts received through that integration.
Dynamic labels: Extracted from the alert payload and added dynamically to alert groups.

For configuration instructions, refer to Configure labels.

Label behavior

Assignment limits: Each alert group can have up to 50 labels. If more than 50 labels are assigned, only the first 50 (sorted alphabetically) are applied.
Label persistence: Once a label is assigned to an alert group, it remains unchanged, even if the label is later modified. This ensures historical accuracy in alert tracking.

Apply labels to incidents

You can apply labels to both active and resolved incidents using the + Add Label option in the incident card. Labels are displayed as key-value pairs, such as team_name:platform or service_name:checkout.

When you create an incident from an alert group, its labels carry over automatically. You can also manually add additional labels directly to alert groups and incidents. This helps you correlate incidents with alerts and SLOs using shared labels.

Example use cases

Filter dashboards: Use consistent labels across incidents, alert groups, and SLOs to filter Grafana SLO dashboards by incidents sharing the same service_name label.
Targeted notifications: Automatically notify the correct team by labeling an active incident with a specific squad.
Automated actions: Trigger custom webhooks when an incident matches specific labels, such as a particular cluster or namespace.

Labels and Service Center

The Service Center helps you define services and their dependencies. Labels connect alert groups and incidents to Service Center, enabling service-aware alerting and dependency tracking.

Use the service_name label to connect alert groups and incidents to Service Center.
Ensure the service_name label matches the defined service identifier to enable IRM to associate alert groups with corresponding services.

For more information, refer to the Service Center documentation.

Labels and service dependencies

Service dependencies represent upstream services that your service relies on. Identifying these dependencies helps speed up issue resolution by highlighting the impact of related services.

IRM can inform you when an upstream service has an active alert group, indicating a potential impact on your service.

For IRM to link alert groups with service dependencies, the following configurations must be in place:

Configured service dependencies in Service Center.
Defined service_name labels in your integration settings.
service_name label values that match the service identifiers in Service Center.

For more information, refer to Configure upstream dependencies.