class_docstr: Dispatch alerts to the alert processor.
class_docstr_tok: ["Dispatch","alerts","to","the","alert","processor","."]
docstr: Gather alerts into groupings which can be merged together and sent now.
  
  Args:
      alerts (list): List of Alert instances with defined merge configuration.
  
  Returns:
      list<AlertMergeGroup>: Each returned merge group has the following properties:
          (1) The oldest alert is older than its merge window (i.e. should be sent now), AND
          (2) All alerts in the merge group fit within a single merge window, AND
          (3) All alerts in the merge group have the same values for all of their merge keys.
  
      Alerts which are too recent to fit in any merge group are excluded from the results.
docstr_tok: ["Gather","alerts","into","groupings","which","can","be","merged","together","and","sent","now",".","Args",":","alerts","(","list",")",":","List","of","Alert","instances","with","defined","merge","configuration",".","Returns",":","list","<","AlertMergeGroup",">",":","Each","returned","merge","group","has","the","following","properties",":","(","1",")","The","oldest","alert","is","older","than","its","merge","window","(","i.e",".","should","be","sent","now",")",",","AND","(","2",")","All","alerts","in","the","merge","group","fit","within","a","single","merge","window",",","AND","(","3",")","All","alerts","in","the","merge","group","have","the","same","values","for","all","of","their","merge","keys",".","Alerts","which","are","too","recent","to","fit","in","any","merge","group","are","excluded","from","the","results","."]
code: def _merge_groups(alerts):
      """Gather alerts into groupings which can be merged together and sent now.
  
      Args:
          alerts (list): List of Alert instances with defined merge configuration.
  
      Returns:
          list<AlertMergeGroup>: Each returned merge group has the following properties:
              (1) The oldest alert is older than its merge window (i.e. should be sent now), AND
              (2) All alerts in the merge group fit within a single merge window, AND
              (3) All alerts in the merge group have the same values for all of their merge keys.
  
          Alerts which are too recent to fit in any merge group are excluded from the results.
      """
      merge_groups = []
  
      for alert in sorted(alerts):
          # Iterate over alerts (in order of creation) and try to add them to each merge group.
          if not any(group.add(alert) for group in merge_groups):
              # The alert doesn't fit in any merge group - try creating a new one.
              if datetime.utcnow() < alert.created + alert.merge_window:
                  # This alert is too recent - no other alerts can be merged. Stop here.
                  break
              merge_groups.append(AlertMergeGroup(alert))
  
      return merge_groups
  
file_path: streamalert/streamalert/alert_merger/main.py
imports: from datetime import datetime
  import json
  import os
  import boto3
  from streamalert.shared.alert import Alert, AlertCreationError
  from streamalert.shared.alert_table import AlertTable
  from streamalert.shared.logger import get_logger
  from streamalert.shared.metrics import ALERT_MERGER_NAME, MetricLogger
label_desc: Use image node_id 4 for calling the AlertMerger obj's underlying member method code with example usage: obj._merge_groups(alerts) and returns: merge_groups