Multiple Chains vs Multiple Lines
This guide helps with one of the most common escalation design questions in 1stLine by Burava:
should this be another Chain, or just another Line in the same Chain?
Short answer
Use:
- another Chain when the alert should follow a different escalation path
- another Line when the alert should stay in the same path but move to the next step
That difference is the core design rule.
Use multiple Chains when the path itself changes
Create separate Chains when alerts should be routed into clearly different paths, for example:
- Payments alerts should go to the Payments response path
- Platform alerts should go to the Platform response path
- customer-facing critical alerts should go to a shorter, more urgent path
- non-production alerts should go to a lower-noise path
In these cases, the alerts should not share one path with a few timing differences. They should start in different paths.
That means the split belongs in Routing Rules and Chains.
Use multiple Lines when the path is the same
Add more Lines when the alert should keep moving through the same escalation path, for example:
- primary on-call first
- backup responder second
- team-wide fallback third
That is still one path. It just has several steps.
In these cases, the split belongs in Lines and Line Members.
A concrete example
Example 1: one service, step-by-step fallback
You have one service. All alerts should first go to the on-call person, then to a backup, then to a wider group.
Use:
- one Chain
- three Lines
Why: the path stays the same from start to finish.
Example 2: two services with different owners
You have two services with different teams and different escalation logic.
Use:
- two Chains
- one or more Lines inside each Chain
- Routing Rules that choose the right Chain per alert
Why: the alerts should enter different paths from the start.
Example 3: same service, different urgency
High-severity alerts for one service should wake the on-call engineer immediately, but lower-severity alerts should start with a softer path.
Usually use:
- two Chains
- separate Routing Rules based on severity or priority
Why: the full path changes, not just the next step.
Practical decision test
Ask this question:
If the alert matches, should it start in a different response path, or should it just continue to a later step in the same path?
If it should start in a different path, create another Chain.
If it should continue to another step in the same path, add another Line.
Build the simplest version first
When you are unsure, start with the smallest model that clearly matches the workflow:
- one Chain per real path
- one Line per real step
- one Routing Rule per clear matching decision
That keeps the model easier to read, test, and maintain.