When an alarm triggers, a ticket is created in Freshservice, and the on-call team member has to stop everything, open a spreadsheet, find the right person’s name, head to Slack, and tag them. Every single time.It becomes very difficult specially when the team is dealing with multiple alerts, that five step manual process adds real delay to incident response.<\/p>\n
This blog covers an automation built in order to remove that lookup step entirely. When an alert ticket is created, the system now automatically finds the right person and posts that information as a private note directly on the ticket. so that the on-call team members already know exactly who to tag in Slack, without opening anything else.<\/p>\n
When an alert is triggered by monitoring tool, a ticket is created in Freshservice. And the team had to refer sheet to find out who owns that alert type and what is the priority of that alert. The process was clear. But it was entirely manual and time consuming.<\/p>\n
After automating this process, when an alert ticket is created, a private note is automatically added in the ticket saying who to tag and at what priority.<\/p>\n
When a monitoring tool detects an issue, a ticket is created in Freshservice. The subject line looks like:<\/p>\n
\u00a0\r\nALARM: CPU high in US West (Oregon)<\/strong><\/pre>\nStep 2 – Freshservice fires a webhook<\/h2>\n
An automator rule in Freshservice watches for ticket. When the ticket is created, it automatically sends ticket id and ticket subject to a Cloudflare Worker:<\/p>\n
{<\/strong>\r\n\"ticket_id\": \"12345\",<\/strong>\r\n\"ticket_subject\": \"ALARM: CPU high in US West (Oregon)\"<\/strong>\r\n}<\/strong><\/pre>\nStep 3 – The Cloudflare Worker passes the information<\/h2>\n
The Worker takes the exact same data and passes it to the Google Apps Script.<\/p>\n
Why does this relay exist ?<\/h3>\n
Google Apps Script don’t respond to requests directly. When called, Google first sends back a redirect (HTTP 302) pointing to a separate link, and the real response lives there. Freshservice’s webhook caller doesn’t know how to follow that kind of redirect, it would just report the call as failed.<\/p>\n
The Worker fixes this by:<\/p>\n
\n
- Calling Google Apps Script<\/li>\n
- Receiving the redirect<\/li>\n
- Following it to the real response<\/li>\n
- Returning a response “OK” back to Freshservice<\/li>\n<\/ul>\n
Step 4 – Google Apps Script Does the Real Work<\/h2>\n
This is where the logic lives. The script does three things:<\/p>\n
1. Cleans up the subject line<\/p>\n
Alert names from monitoring tools are messy and inconsistent. The same alert might arrive as:<\/p>\n
ALARM: CPU high in US West (Oregon)
\n“CPU High” in EU West
\nCPU high
\nA direct match would fail on all of these. So the script normalizes everything first \u2014 stripping the ALARM: prefix, removing quote characters, and cutting off region suffixes:<\/p>\nfunction normalizeSubject(subject) {<\/strong>\r\nreturn subject<\/strong>\r\n.toLowerCase()<\/strong>\r\n.replace(\/alarm:\\s*\/i, \"\")<\/strong>\r\n.replace(\/['\"\u00ab\u00bb\"\"''`]\/g, \"\")<\/strong>\r\n.replace(\/\\sin\\s+(us|eu|ap)\\s+.$\/i, \"\")<\/strong>\r\n.replace(\/\\s+\/g, \" \")<\/strong>\r\n.trim();<\/strong>\r\n}<\/strong><\/pre>\n<\/h2>\n
All three examples above become cpu high \u2014 which is what the sheet row says too.<\/p>\n
2. Searches the Google Sheet<\/p>\n
The sheet has multiple tabs, one per alert category. Each row has three columns:<\/p>\n
Column A \u2014 Alert name
\nColumn B \u2014 Who to tag in Slack
\nColumn C \u2014 Priority
\nThe script searches every tab, normalizes each row’s alert name the same way, and checks if the ticket subject and the sheet row contain each other (a fuzzy two-way match). The first match wins.<\/p>\n3. Posts the note on the ticket<\/p>\n
Once a match is found, the script calls the Freshservice API and posts a private note directly on the ticket:<\/p>\n
Alert Type: Server Alerts\r\nTag in Slack: @John\r\nPriority: High\r\nPlease tag the above person(s) in Slack when posting the alert and findings.<\/pre>\nWhat if there’s no match?<\/p>\n
The script posts a different note instead:<\/p>\n
\u26a0\ufe0f No match found in tagging sheet.\r\nTicket Subject: ALARM: CPU high in US West (Oregon)\r\nNormalized: cpu high\r\nPlease check the sheet manually.<\/pre>\nThis is just as important as the match case. Without it, unmatched alerts would fail silently. With it, gaps show up clearly and the sheet can be updated to fix them.<\/p>\n
Step 5 – A Person Tags Slack<\/h2>\n
Whoever picks up the ticket reads the note and tags the right person in Slack by hand. The automation stops at writing the note \u2014 the actual Slack message involves context and judgment, so that part stays manual.<\/p>\n
What the Full Flow Looks Like<\/p>\n
Alarm fires
\n\u2192 Freshservice ticket created
\n\u2192 Automator rule fires webhook
\n\u2192 Cloudflare Worker receives it
\n\u2192 Passes it to Google Apps Script
\n\u2192 Script cleans up subject line
\n\u2192 Searches Google Sheet
\n\u2192 Posts private note on ticket
\n\u2192 Person reads note \u2192 Tags Slack<\/p>\nCurrent Status and Open Items
\nThe automation is built but not yet live. Two things need to be addressed before switching it on:<\/p>\nAPI key exposure \u2014 The Freshservice API key is currently hardcoded in plain text inside the script. It needs to be moved to Script Properties (Google’s built-in secret store) and the current key should be rotated.
\nAutomator rule is off \u2014 The Freshservice rule is currently set to Inactive. It gets turned on once the API key issue is resolved.<\/p>\nConclusion<\/h1>\n
What started as a small, annoying five-step manual task turned into a clean end-to-end automation using tools the team already had \u2014 Freshservice, Google Sheets, and a lightweight script.<\/p>\n
The biggest lesson? The normalization step made or broke the whole thing. Alert names from monitoring tools are never clean or consistent, and a direct string match would have failed most of the time. Getting that cleanup logic right was the difference between an automation that works on paper and one that works in the real world.<\/p>\n
The no-match note was the second key decision. It’s easy to only think about the happy path \u2014 but surfacing gaps clearly, rather than letting them fail silently, is what makes a system trustworthy over time.<\/p>\n
If your team is dealing with a similar problem \u2014 alert routing, ticket tagging, on-call lookups \u2014 this same pattern applies. No new infrastructure or expensive tools are needed. A spreadsheet, a script, and a webhook can go a long way.<\/p>\n
Does your team still handle this manually? Or have you built something similar? Drop a comment below \u2014 it would be great to hear how others are approaching alert routing.<\/p>\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
Introduction When an alarm triggers, a ticket is created in Freshservice, and the on-call team member has to stop everything, open a spreadsheet, find the right person’s name, head to Slack, and tag them. Every single time.It becomes very difficult specially when the team is dealing with multiple alerts, that five step manual process adds […]<\/p>\n","protected":false},"author":1873,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"iawp_total_views":8,"footnotes":""},"categories":[5877],"tags":[8799,8798,3812],"class_list":["post-81097","post","type-post","status-publish","format-standard","hentry","category-msp","tag-cloudflareworkers","tag-freshservice","tag-slack"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t