← All case studiesFinancial Services · Elastic consulting

Case study

1.9 Million Duplicate Tickets Cleared for a Top-Tier US Financial Institution

How SquareShift built a five-pipeline system that cleared a backlog of roughly 1.9 million duplicate tickets and now runs incident creation, deduplication, and closure automatically for a top-tier US bank.

Book a session →
5pipelines handling incident creation, deduplication and closure
3metadata fields stamped on every alert: server, environment, owner
0data dropped when a downstream platform goes offline

Client

A top-tier US financial institution that operates at enterprise scale under strict regulatory rules.

Industry

Financial Services

Services

ObObservability & ReliabilityPePlatform & Software Engineering

Stack

Incident Automation Pipeline · Metadata Tagging · Deduplication Engine

How SquareShift delivered it.

01

The challenge

A flaw in the client's single monitoring platform generated roughly 1.9 million duplicate tickets that staff had to clear by hand, burying the operations team in noise. Alerts arrived with no context, so analysts had to cross-reference an outside database during every triage, and alerts came in through multiple disconnected platforms.

02

What we delivered

SquareShift built a five-pipeline system that handles incident creation, deduplication, real-time updates, and closure end to end, stamping each alert with server, environment, and ownership metadata as it arrives instead of leaving analysts to look it up separately.

Durable buffering queues and fallback rules keep ingestion running even when a downstream platform has an outage, so a failure elsewhere no longer blocks incoming data. For alert and incident automation, see our Elastic search and observability services.

03

The outcome

The backlog of roughly 1.9 million duplicate tickets is now cleared, and incident handling runs automatically from start to finish across the institution's cloud and on-premises systems.

“
A duplicate ticket isn't a nuisance at 1.9 million — it's what stands between your team and the real incidents underneath it. Fixing deduplication was the highest-leverage change on the whole platform.

Observability & Reliability Practice Lead, SquareShift

Related work