@oneuptime/common 10.0.96 → 10.0.98

package/Server/Services/HostService.ts

@@ -0,0 +1,251 @@
+import DatabaseService from "./DatabaseService";
+import Model from "../../Models/DatabaseModels/Host";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import ObjectID from "../../Types/ObjectID";
+import QueryHelper from "../Types/Database/QueryHelper";
+import OneUptimeDate from "../../Types/Date";
+import LIMIT_MAX from "../../Types/Database/LimitMax";
+import GlobalCache from "../Infrastructure/GlobalCache";
+import crypto from "crypto";
+
+const LAST_SEEN_CACHE_NAMESPACE: string = "host-last-seen";
+const LAST_SEEN_THROTTLE_SECONDS: number = 60;
+
+export class Service extends DatabaseService<Model> {
+  public constructor() {
+    super(Model);
+  }
+
+  @CaptureSpan()
+  public async findOrCreateByHostIdentifier(data: {
+    projectId: ObjectID;
+    hostIdentifier: string;
+  }): Promise<Model> {
+    const existingHost: Model | null = await this.findOneBy({
+      query: {
+        projectId: data.projectId,
+        hostIdentifier: data.hostIdentifier,
+      },
+      select: {
+        _id: true,
+        projectId: true,
+        hostIdentifier: true,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    if (existingHost) {
+      return existingHost;
+    }
+
+    try {
+      const newHost: Model = new Model();
+      newHost.projectId = data.projectId;
+      newHost.name = data.hostIdentifier;
+      newHost.hostIdentifier = data.hostIdentifier;
+      newHost.otelCollectorStatus = "connected";
+      newHost.lastSeenAt = OneUptimeDate.getCurrentDate();
+
+      const createdHost: Model = await this.create({
+        data: newHost,
+        props: {
+          isRoot: true,
+        },
+      });
+
+      return createdHost;
+    } catch {
+      const reFetchedHost: Model | null = await this.findOneBy({
+        query: {
+          projectId: data.projectId,
+          hostIdentifier: data.hostIdentifier,
+        },
+        select: {
+          _id: true,
+          projectId: true,
+          hostIdentifier: true,
+        },
+        props: {
+          isRoot: true,
+        },
+      });
+
+      if (reFetchedHost) {
+        return reFetchedHost;
+      }
+
+      throw new Error("Failed to create or find host: " + data.hostIdentifier);
+    }
+  }
+
+  @CaptureSpan()
+  public async updateLastSeen(
+    hostId: ObjectID,
+    extra?: {
+      osType?: string | undefined;
+      osVersion?: string | undefined;
+      hostId?: string | undefined;
+      hostArch?: string | undefined;
+      hostType?: string | undefined;
+      hostIpAddresses?: string | undefined;
+      cpuCores?: number | undefined;
+      totalMemoryBytes?: number | undefined;
+      processCount?: number | undefined;
+      containerRuntime?: string | undefined;
+      dockerHostId?: ObjectID | undefined;
+      kubernetesClusterId?: ObjectID | undefined;
+    },
+  ): Promise<void> {
+    /*
+     * Throttle: the same telemetry batch repeats every metric/log/trace
+     * push and re-sends identical host metadata. Skip the DB write when
+     * we recently wrote the exact same values; only refresh `lastSeenAt`
+     * once per throttle window. If any extra value changed (e.g. cpuCores
+     * updated, IP address changed), bust the cache and write immediately.
+     */
+    const cacheKey: string = hostId.toString();
+    const extrasFingerprint: string = this.fingerprintExtras(extra);
+    const cached: string | null = await GlobalCache.getString(
+      LAST_SEEN_CACHE_NAMESPACE,
+      cacheKey,
+    );
+
+    if (cached === extrasFingerprint) {
+      return; // same data was written recently
+    }
+
+    await GlobalCache.setString(
+      LAST_SEEN_CACHE_NAMESPACE,
+      cacheKey,
+      extrasFingerprint,
+      { expiresInSeconds: LAST_SEEN_THROTTLE_SECONDS },
+    );
+
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const data: any = {
+      lastSeenAt: OneUptimeDate.getCurrentDate(),
+      otelCollectorStatus: "connected",
+    };
+
+    if (extra?.osType) {
+      data.osType = extra.osType;
+    }
+    if (extra?.osVersion) {
+      data.osVersion = extra.osVersion;
+    }
+    if (extra?.hostId) {
+      data.hostId = extra.hostId;
+    }
+    if (extra?.hostArch) {
+      data.hostArch = extra.hostArch;
+    }
+    if (extra?.hostType) {
+      data.hostType = extra.hostType;
+    }
+    if (extra?.hostIpAddresses) {
+      data.hostIpAddresses = extra.hostIpAddresses;
+    }
+    if (extra?.cpuCores !== undefined) {
+      data.cpuCores = extra.cpuCores;
+    }
+    if (extra?.totalMemoryBytes !== undefined) {
+      data.totalMemoryBytes = extra.totalMemoryBytes;
+    }
+    if (extra?.processCount !== undefined) {
+      data.processCount = extra.processCount;
+    }
+    if (extra?.containerRuntime) {
+      data.containerRuntime = extra.containerRuntime;
+    }
+    if (extra?.dockerHostId) {
+      data.dockerHostId = extra.dockerHostId;
+    }
+    if (extra?.kubernetesClusterId) {
+      data.kubernetesClusterId = extra.kubernetesClusterId;
+    }
+
+    await this.updateOneById({
+      id: hostId,
+      data: data,
+      props: {
+        isRoot: true,
+      },
+    });
+  }
+
+  private fingerprintExtras(extra?: {
+    osType?: string | undefined;
+    osVersion?: string | undefined;
+    hostId?: string | undefined;
+    hostArch?: string | undefined;
+    hostType?: string | undefined;
+    hostIpAddresses?: string | undefined;
+    cpuCores?: number | undefined;
+    totalMemoryBytes?: number | undefined;
+    processCount?: number | undefined;
+    containerRuntime?: string | undefined;
+    dockerHostId?: ObjectID | undefined;
+    kubernetesClusterId?: ObjectID | undefined;
+  }): string {
+    const normalized: Record<string, string | number | null> = {
+      osType: extra?.osType ?? null,
+      osVersion: extra?.osVersion ?? null,
+      hostId: extra?.hostId ?? null,
+      hostArch: extra?.hostArch ?? null,
+      hostType: extra?.hostType ?? null,
+      hostIpAddresses: extra?.hostIpAddresses ?? null,
+      cpuCores: extra?.cpuCores ?? null,
+      totalMemoryBytes: extra?.totalMemoryBytes ?? null,
+      processCount: extra?.processCount ?? null,
+      containerRuntime: extra?.containerRuntime ?? null,
+      dockerHostId: extra?.dockerHostId?.toString() ?? null,
+      kubernetesClusterId: extra?.kubernetesClusterId?.toString() ?? null,
+    };
+
+    return crypto
+      .createHash("sha1")
+      .update(JSON.stringify(normalized))
+      .digest("hex");
+  }
+
+  @CaptureSpan()
+  public async markDisconnectedHosts(): Promise<void> {
+    const fiveMinutesAgo: Date = OneUptimeDate.addRemoveMinutes(
+      OneUptimeDate.getCurrentDate(),
+      -5,
+    );
+
+    const connectedHosts: Array<Model> = await this.findBy({
+      query: {
+        otelCollectorStatus: "connected",
+        lastSeenAt: QueryHelper.lessThan(fiveMinutesAgo),
+      },
+      select: {
+        _id: true,
+      },
+      limit: LIMIT_MAX,
+      skip: 0,
+      props: {
+        isRoot: true,
+      },
+    });
+
+    for (const host of connectedHosts) {
+      if (host._id) {
+        await this.updateOneById({
+          id: new ObjectID(host._id.toString()),
+          data: {
+            otelCollectorStatus: "disconnected",
+          },
+          props: {
+            isRoot: true,
+          },
+        });
+      }
+    }
+  }
+}
+
+export default new Service();

package/Server/Services/LogAggregationService.ts

@@ -669,14 +669,21 @@ export class LogAggregationService {
       for (const [attrKey, attrValue] of Object.entries(request.attributes)) {
         LogAggregationService.validateFacetKey(attrKey);
 
+        /*
+         * Match attribute keys case-insensitively — keys in the data come
+         * from many sources (OTEL conventions are dot.lowercase, app code
+         * often uses camelCase like `requestId`), and forcing users to
+         * remember the exact casing is a poor experience. The user-supplied
+         * key is validated above.
+         */
         statement.append(
-          SQL` AND attributes[${{
+          SQL` AND arrayExists((k, v) -> lowerUTF8(k) = lowerUTF8(${{
             type: TableColumnType.Text,
             value: attrKey,
-          }}] = ${{
+          }}) AND v = ${{
             type: TableColumnType.Text,
             value: attrValue,
-          }}`,
+          }}, mapKeys(attributes), mapValues(attributes))`,
         );
       }
     }

package/Server/Services/MetricService.ts

@@ -57,6 +57,20 @@ export class MetricService extends AnalyticsDatabaseService<Metric> {
     columns: Array<string>;
   } {
     if (!isPercentileAggregation(aggregateBy.aggregationType)) {
+      /*
+       * Try the per-host MV first — host detail pages are the
+       * dominant attribute-filtered path and the per-host MV is
+       * the only one that can serve them. If it doesn't apply
+       * (no host filter, or extra attrs/groupBy), fall through
+       * to the project/serviceId MV, then to the base table.
+       */
+      const hostMvStatement: {
+        statement: Statement;
+        columns: Array<string>;
+      } | null = this.tryBuildHostAggregateMVStatement(aggregateBy);
+      if (hostMvStatement) {
+        return hostMvStatement;
+      }
       const mvStatement: {
         statement: Statement;
         columns: Array<string>;
@@ -401,6 +415,192 @@ export class MetricService extends AnalyticsDatabaseService<Metric> {
     };
   }
 
+  /*
+   * Per-host materialized-view fast path.
+   *
+   * Returns a statement that reads from MetricItemAggMV1mByHost
+   * (created by AddMetricMinuteAggregateByHostMaterializedView)
+   * when:
+   *
+   *   - The aggregation is Sum/Avg/Min/Max/Count over `value`.
+   *   - The only attribute filter is `resource.host.name` as a
+   *     bare-string equality (the dashboard's host detail page
+   *     pattern).
+   *   - The query carries no group-by other than the time
+   *     bucket — the MV is keyed by hostIdentifier and does not
+   *     preserve other attribute breakdowns.
+   *
+   * Returns `null` if any condition fails so the caller falls
+   * through to the next fast path / base table. The result row
+   * shape (columns: aggregateColumn, timestampColumn) matches
+   * the base statement so downstream code needs no changes.
+   */
+  private tryBuildHostAggregateMVStatement(
+    aggregateBy: AggregateBy<Metric>,
+  ): { statement: Statement; columns: Array<string> } | null {
+    const aggType: AggregationType = aggregateBy.aggregationType;
+    const supported: ReadonlyArray<AggregationType> = [
+      AggregationType.Sum,
+      AggregationType.Avg,
+      AggregationType.Min,
+      AggregationType.Max,
+      AggregationType.Count,
+    ];
+    if (!supported.includes(aggType)) {
+      return null;
+    }
+
+    if (
+      aggregateBy.aggregateColumnName.toString() !== "value" ||
+      aggregateBy.aggregationTimestampColumnName.toString() !== "time"
+    ) {
+      return null;
+    }
+
+    if (aggregateBy.groupBy && Object.keys(aggregateBy.groupBy).length > 0) {
+      return null;
+    }
+
+    /*
+     * Inspect the attribute filter. This MV is only safe when
+     * the user is filtering by exactly one attribute,
+     * `resource.host.name`, with a bare-string value (the
+     * canonical Overview/Metrics-page pattern). Anything else —
+     * extra attribute filters, NotEqual, Search, etc. — has to
+     * fall back so the result stays correct.
+     */
+    const queryRecord: Record<string, unknown> =
+      (aggregateBy.query as unknown as Record<string, unknown>) || {};
+    const attrs: unknown = queryRecord["attributes"];
+    if (!attrs || typeof attrs !== "object") {
+      return null;
+    }
+    const attrEntries: Array<[string, unknown]> = Object.entries(
+      attrs as Record<string, unknown>,
+    );
+    if (attrEntries.length !== 1) {
+      return null;
+    }
+    const [attrKey, attrValue] = attrEntries[0]!;
+    if (attrKey !== "resource.host.name") {
+      return null;
+    }
+    if (attrValue === undefined || attrValue === null) {
+      return null;
+    }
+    const hostIdentifier: string =
+      typeof attrValue === "string" ? attrValue : "";
+    if (!hostIdentifier) {
+      return null;
+    }
+
+    const interval: AggregationInterval = AggregateUtil.getAggregationInterval({
+      startDate: aggregateBy.startTimestamp!,
+      endDate: aggregateBy.endTimestamp!,
+    });
+    void interval;
+
+    if (!this.database) {
+      this.useDefaultDatabase();
+    }
+    const databaseName: string = this.database.getDatasourceOptions().database!;
+
+    const intervalLower: string = interval.toLowerCase();
+
+    let mergedExpr: string;
+    if (aggType === AggregationType.Sum) {
+      mergedExpr = `sumMerge(valueSumState)`;
+    } else if (aggType === AggregationType.Count) {
+      mergedExpr = `countMerge(valueCountState)`;
+    } else if (aggType === AggregationType.Min) {
+      mergedExpr = `minMerge(valueMinState)`;
+    } else if (aggType === AggregationType.Max) {
+      mergedExpr = `maxMerge(valueMaxState)`;
+    } else {
+      mergedExpr = `if(countMerge(valueCountState) = 0, 0, sumMerge(valueSumState) / countMerge(valueCountState))`;
+    }
+
+    /*
+     * Strip both `time` (column doesn't exist on the MV; we
+     * inject an explicit bucketTime range below) and
+     * `attributes` (the attribute filter is now an explicit
+     * `hostIdentifier =` predicate against an MV column).
+     */
+    const filteredQuery: typeof aggregateBy.query =
+      this.stripAttributesAndTimeFromQuery(
+        aggregateBy.query,
+      ) as typeof aggregateBy.query;
+    const nonTimeWhere: Statement =
+      this.statementGenerator.toWhereStatement(filteredQuery);
+    const sortStatement: Statement = this.statementGenerator.toSortStatement(
+      aggregateBy.sort!,
+    );
+
+    const statement: Statement = SQL``;
+
+    statement.append(
+      `SELECT ${mergedExpr} as value, date_trunc('${intervalLower}', toStartOfInterval(bucketTime, INTERVAL 1 ${intervalLower})) as time`,
+    );
+    statement.append(SQL` FROM ${databaseName}.MetricItemAggMV1mByHost`);
+    statement.append(
+      ` WHERE bucketTime >= toDateTime('${this.formatDateTime(aggregateBy.startTimestamp!)}') AND bucketTime <= toDateTime('${this.formatDateTime(aggregateBy.endTimestamp!)}')`,
+    );
+    statement.append(
+      SQL` AND hostIdentifier = ${{
+        value: hostIdentifier,
+        type: TableColumnType.Text,
+      }}`,
+    );
+    statement.append(SQL` `).append(nonTimeWhere);
+
+    statement.append(SQL` GROUP BY `).append(`time`);
+    statement.append(SQL` ORDER BY `).append(sortStatement);
+    statement.append(
+      SQL` LIMIT ${{
+        value: Number(aggregateBy.limit),
+        type: TableColumnType.Number,
+      }}`,
+    );
+    statement.append(
+      SQL` OFFSET ${{
+        value: Number(aggregateBy.skip),
+        type: TableColumnType.Number,
+      }} `,
+    );
+    statement.append(
+      ` SETTINGS optimize_aggregation_in_order=1, optimize_move_to_prewhere=1, max_threads=4`,
+    );
+
+    logger.debug(`${this.model.tableName} Host MV Aggregate Statement`, {
+      tableName: this.model.tableName,
+    } as LogAttributes);
+    logger.debug(statement, {
+      tableName: this.model.tableName,
+    } as LogAttributes);
+
+    return {
+      statement,
+      columns: [
+        aggregateBy.aggregateColumnName.toString(),
+        aggregateBy.aggregationTimestampColumnName.toString(),
+      ],
+    };
+  }
+
+  private stripAttributesAndTimeFromQuery(query: unknown): typeof query {
+    if (!query || typeof query !== "object") {
+      return query;
+    }
+    const out: Record<string, unknown> = {};
+    for (const [k, v] of Object.entries(query as Record<string, unknown>)) {
+      if (k === "time" || k === "attributes") {
+        continue;
+      }
+      out[k] = v;
+    }
+    return out as typeof query;
+  }
+
   private stripTimeFromQuery(query: unknown): typeof query {
     if (!query || typeof query !== "object") {
       return query;

package/Server/Services/TraceAggregationService.ts

@@ -503,14 +503,19 @@ export class TraceAggregationService {
       for (const [attrKey, attrValue] of Object.entries(request.attributes)) {
         TraceAggregationService.validateFacetKey(attrKey);
 
+        /*
+         * Match attribute keys case-insensitively — see the matching note in
+         * LogAggregationService.appendCommonFilters. Casings vary across
+         * OTEL conventions and app-emitted attributes.
+         */
         statement.append(
-          SQL` AND attributes[${{
+          SQL` AND arrayExists((k, v) -> lowerUTF8(k) = lowerUTF8(${{
             type: TableColumnType.Text,
             value: attrKey,
-          }}] = ${{
+          }}) AND v = ${{
             type: TableColumnType.Text,
             value: attrValue,
-          }}`,
+          }}, mapKeys(attributes), mapValues(attributes))`,
         );
       }
     }

package/Server/Utils/AnalyticsDatabase/StatementGenerator.ts

@@ -463,10 +463,35 @@ export default class StatementGenerator<TBaseModel extends AnalyticsBaseModel> {
           }
 
           /*
-           * ClickHouse Map columns return the value type's default for
-           * missing keys (empty string for String values), so to express
-           * "is empty" we have to cover both the missing-key and the
-           * empty-string case explicitly.
+           * Map filters split into two paths:
+           *
+           * 1. Programmatic equality / null / numeric comparisons —
+           *    EqualTo, NotEqual, IsNull, NotNull, GreaterThan, etc.,
+           *    or bare string/number values. Callers are dashboard
+           *    pages and services that pass canonical keys already
+           *    matching the stored casing, so we use ClickHouse's
+           *    direct Map subscript `attributes['k']`. That's an O(1)
+           *    hash lookup per row and lets the query planner push the
+           *    predicate into PREWHERE, instead of paying the
+           *    `arrayExists((k, v) -> lowerUTF8(k) = lowerUTF8(...))`
+           *    cost which materializes mapKeys/mapValues per row and
+           *    lowercases every stored key on every query. Restoring
+           *    this fast path is the single biggest performance fix
+           *    for Host / Logs / Traces detail pages.
+           *
+           * 2. User-typed substring/wildcard operators — Search,
+           *    StartsWith, EndsWith, NotContains. These come from the
+           *    search bar where users shouldn't have to remember
+           *    whether the attribute key is `requestId` or `requestid`,
+           *    so we keep the case-insensitive `arrayExists` form. The
+           *    cost is acceptable because a search-bar query is
+           *    bounded (one user, one click) and these operators
+           *    already imply a row scan.
+           *
+           * ClickHouse Map subscripts return the value type's default
+           * for missing keys (empty string for String values), which
+           * is what the IsNull / NotNull / NotEqual branches below
+           * mirror to preserve the previous semantics.
            */
           if (mapEntry instanceof IsNull) {
             whereStatement.append(
@@ -496,13 +521,13 @@ export default class StatementGenerator<TBaseModel extends AnalyticsBaseModel> {
 
           if (mapEntry instanceof Search) {
             whereStatement.append(
-              SQL`AND ${key}[${{
+              SQL`AND arrayExists((k, v) -> lowerUTF8(k) = lowerUTF8(${{
                 value: mapKey,
                 type: TableColumnType.Text,
-              }}] ILIKE ${{
+              }}) AND v ILIKE ${{
                 value: mapEntry as Search<string>,
                 type: TableColumnType.Text,
-              }}`,
+              }}, mapKeys(${key}), mapValues(${key}))`,
             );
             continue;
           }
@@ -510,13 +535,13 @@ export default class StatementGenerator<TBaseModel extends AnalyticsBaseModel> {
           if (mapEntry instanceof NotContains) {
             const literalValue: string = `%${(mapEntry.value as string) || ""}%`;
             whereStatement.append(
-              SQL`AND ${key}[${{
+              SQL`AND NOT arrayExists((k, v) -> lowerUTF8(k) = lowerUTF8(${{
                 value: mapKey,
                 type: TableColumnType.Text,
-              }}] NOT ILIKE ${{
+              }}) AND v ILIKE ${{
                 value: literalValue,
                 type: TableColumnType.Text,
-              }}`,
+              }}, mapKeys(${key}), mapValues(${key}))`,
             );
             continue;
           }
@@ -524,13 +549,13 @@ export default class StatementGenerator<TBaseModel extends AnalyticsBaseModel> {
           if (mapEntry instanceof StartsWith) {
             const literalValue: string = `${(mapEntry.value as string) || ""}%`;
             whereStatement.append(
-              SQL`AND ${key}[${{
+              SQL`AND arrayExists((k, v) -> lowerUTF8(k) = lowerUTF8(${{
                 value: mapKey,
                 type: TableColumnType.Text,
-              }}] ILIKE ${{
+              }}) AND v ILIKE ${{
                 value: literalValue,
                 type: TableColumnType.Text,
-              }}`,
+              }}, mapKeys(${key}), mapValues(${key}))`,
             );
             continue;
           }
@@ -538,13 +563,13 @@ export default class StatementGenerator<TBaseModel extends AnalyticsBaseModel> {
           if (mapEntry instanceof EndsWith) {
             const literalValue: string = `%${(mapEntry.value as string) || ""}`;
             whereStatement.append(
-              SQL`AND ${key}[${{
+              SQL`AND arrayExists((k, v) -> lowerUTF8(k) = lowerUTF8(${{
                 value: mapKey,
                 type: TableColumnType.Text,
-              }}] ILIKE ${{
+              }}) AND v ILIKE ${{
                 value: literalValue,
                 type: TableColumnType.Text,
-              }}`,
+              }}, mapKeys(${key}), mapValues(${key}))`,
             );
             continue;
           }
@@ -577,7 +602,10 @@ export default class StatementGenerator<TBaseModel extends AnalyticsBaseModel> {
 
           /*
            * Map values are stored as text; cast to Float64 for numeric
-           * comparisons and skip rows where the cast fails (non-numeric).
+           * comparisons. toFloat64OrNull yields NULL for non-numeric
+           * values (including the empty-string default for missing
+           * keys), which compares to false against any numeric
+           * threshold and naturally drops those rows.
            */
           if (mapEntry instanceof GreaterThan) {
             whereStatement.append(
@@ -631,7 +659,7 @@ export default class StatementGenerator<TBaseModel extends AnalyticsBaseModel> {
             continue;
           }
 
-          // Bare string/number/boolean — back-compat with existing data.
+          // Bare string/number/boolean — direct Map subscript.
           whereStatement.append(
             SQL`AND ${key}[${{
               value: mapKey,

package/Server/Utils/Monitor/MonitorAlert.ts

@@ -1,6 +1,7 @@
 import Alert from "../../../Models/DatabaseModels/Alert";
 import AlertSeverity from "../../../Models/DatabaseModels/AlertSeverity";
 import AlertStateTimeline from "../../../Models/DatabaseModels/AlertStateTimeline";
+import Host from "../../../Models/DatabaseModels/Host";
 import Label from "../../../Models/DatabaseModels/Label";
 import Monitor from "../../../Models/DatabaseModels/Monitor";
 import OnCallDutyPolicy from "../../../Models/DatabaseModels/OnCallDutyPolicy";
@@ -17,6 +18,7 @@ import { DisableAutomaticAlertCreation } from "../../EnvironmentConfig";
 import AlertService from "../../Services/AlertService";
 import AlertSeverityService from "../../Services/AlertSeverityService";
 import AlertStateTimelineService from "../../Services/AlertStateTimelineService";
+import HostService from "../../Services/HostService";
 import logger, { LogAttributes } from "../Logger";
 import CaptureSpan from "../Telemetry/CaptureSpan";
 import DataToProcess from "./DataToProcess";
@@ -268,6 +270,41 @@ export default class MonitorAlert {
         }
         if (seriesLabels && Object.keys(seriesLabels).length > 0) {
           alert.seriesLabels = seriesLabels;
+
+          /*
+           * Link the alert to the Host that emitted this series, if
+           * the metric carried a `host.name` resource attribute. The
+           * Host record was auto-discovered during OTel ingestion.
+           * Metric attributes are stored with the `resource.` prefix in
+           * ClickHouse, so the group-by dropdown surfaces
+           * `resource.host.name` — but accept the bare `host.name` too
+           * for any non-OTel ingest paths.
+           */
+          const hostName: string | undefined =
+            typeof seriesLabels["resource.host.name"] === "string"
+              ? (seriesLabels["resource.host.name"] as string)
+              : typeof seriesLabels["host.name"] === "string"
+                ? (seriesLabels["host.name"] as string)
+                : undefined;
+
+          if (hostName) {
+            const host: Host | null = await HostService.findOneBy({
+              query: {
+                projectId: input.monitor.projectId!,
+                hostIdentifier: hostName,
+              },
+              select: {
+                _id: true,
+              },
+              props: {
+                isRoot: true,
+              },
+            });
+
+            if (host) {
+              alert.hosts = [host];
+            }
+          }
         }
 
         alert.onCallDutyPolicies =