Alertmanager Extractor

Point at any Prometheus Alertmanager and export its alerts, silences, and status as clean, tabular rows. One actor works against every server that speaks the Alertmanager HTTP API v2 — Prometheus Alertmanager itself and every API-compatible host (the Cortex / Mimir / Grafana alertmanagers). Give it a base URL and a mode; get back rows you can pipe into a sheet, a dataset, a webhook, or another tool.

No Alertmanager UI, no Grafana, no per-server scraper. Just the standard v2 API, turned into structured data.

What it does

Five extraction modes, each turning an Alertmanager endpoint into flat rows:

Mode	Endpoint	One row per…
alerts (default)	/api/v2/alerts	alert currently known to Alertmanager (labels, annotations, state, starts/ends/updated)
alerts_groups	/api/v2/alerts/groups	alert in the grouped notification view, tagged with its group's labels + receiver
silences	/api/v2/silences	silence (id, state, matchers, schedule window, creator, comment)
receivers	/api/v2/receivers	configured receiver name
status	/api/v2/status	server: cluster status + peers, version, build, uptime, loaded config

Example input

{
  "sources": ["https://demo.promlabs.com/alertmanager"],
  "mode": "alerts"
}

Only the critical alerts, across several Alertmanagers at once:

{
  "sources": [
    "https://demo.promlabs.com/alertmanager",
    "https://alertmanager.demo.prometheus.io"
  ],
  "mode": "alerts",
  "filter": ["severity=critical"]
}

List active silences, inspect the grouped view, or read cluster status:

{ "sources": ["https://demo.promlabs.com/alertmanager"], "mode": "silences" }

{ "sources": ["https://demo.promlabs.com/alertmanager"], "mode": "alerts_groups" }

{ "sources": ["https://demo.promlabs.com/alertmanager"], "mode": "status" }

Input reference

• sources (required) — one or more Alertmanager base URLs. Give the bare base (https://demo.promlabs.com/alertmanager) and the actor appends the right /api/v2 path per mode, or paste a full /api/v2/alerts URL. A reverse-proxy sub-path (https://host/alertmanager) is honored.
• mode — one of the five modes above (default alerts).
• filter — zero or more Alertmanager label matchers applied to alerts / alerts_groups / silences (e.g. severity=critical, alertname=~Demo.*, job=demo). Each is sent as a repeated filter= parameter.
• active / silenced / inhibited / unprocessed — booleans that restrict the alert set (alerts / alerts_groups; unprocessed is alerts-only). All default to true (Alertmanager's own default = every alert).
• receiver — an optional receiver-name regex (alerts / alerts_groups).
• maxRecords — a global cap on emitted rows (each row is one event).
• bearer / extraHeaders — optional auth for a gated server (never logged). extraHeaders also carries things like a Cortex/Mimir X-Scope-OrgID tenant header.

Output

Each row is a flat object with a shared schema across all modes — a _type / _mode tag, plus the mode-specific columns. For alerts: alertName, alertState, severity, the full labels and annotations objects, startsAt / endsAt / updatedAt, fingerprint, generatorURL, receiverNames, and silencedBy / inhibitedBy. Timestamps are RFC3339, so they're normalized to a canonical ISO-8601 Z form (with the original kept in the matching *Raw field). The original API object is preserved losslessly in _raw.

Example (alerts mode):

{
  "_type": "alert",
  "_mode": "alerts",
  "fingerprint": "574d7080805ecc54",
  "alertName": "DemoServiceHighErrorRate",
  "alertState": "active",
  "severity": "critical",
  "labels": { "alertname": "DemoServiceHighErrorRate", "job": "demo", "severity": "critical" },
  "annotations": { "title": "High 5xx rate for POST on /api/foo" },
  "startsAt": "2026-07-08T03:15:46.810000Z",
  "endsAt": "2026-07-08T03:48:31.810000Z",
  "receiverNames": ["noop"]
}

Behavior & reliability

• Multi-source, fault-tolerant. A source that is auth-gated, unreachable, rate-limited, or that doesn't implement the v2 API (a bare Prometheus returns a 404) is skipped with a warning; the run continues.
• Honest failures. A malformed filter matcher makes the API return an HTTP 400 (bad matcher format: ...); the actor surfaces that as a real failure rather than silently returning nothing. If every source is unreachable, the run fails rather than reporting a misleading empty success. A reachable host with zero alerts (or zero silences) is a valid empty result and exits clean.

Pricing

Pay-per-event: you're charged per row emitted to the dataset. Point it at a single Alertmanager or a whole fleet; use maxRecords to cap a busy host, and filter to narrow to just the alerts you care about.

Notes

This actor talks to the read side of the Alertmanager HTTP API v2 over plain HTTP(S) JSON. It needs network reach to the server you point it at (a public demo, an internal Alertmanager behind a token, a hosted Cortex/Mimir/Grafana alertmanager). It does not require Grafana or any Prometheus client library. The v2 API is the current interface; the removed v1 API is not targeted.