Logs stream supports threshold alerts.

Creating Alert

Step 1. Define the search query

• Add any required log filters in the “Log Filters” search box

  Open

  

• Log count based charting

  • Use the rate or count_over_time aggregate to chart the count of log lines based on the log filter

    Open

    

• Log Facet based charting

  • Select a log facet to extract and chart. For instance, select a duration facet “took”.

  • Apply a normalization function like 'duration' to interpret the duration string as seconds

  • Choose a aggregation function to aggregate log events in time and generate a time-series

  • Add any grouping facets to “Group by” section. This can reduce the number of time-series

    For more details on Log derived metrics, see Log Derived Metrics section in Logs overview

Step 2: Populate condition and Evaluation

• Populate the Condition section by defining the:

  • aggregate to be used on the query result from the drop-down.

  • query or expression from the drop-down

  • thresholds that should be breached for the alert to be firing

• Populate the Evaluation section by defining the:

  • evaluation frequency that determines the frequency at which alert expression/query must be evaluated (must be a multiple of 10 seconds. For example, 1m, 30s, etc.) and

  • specify the duration for which the condition must be true before an alert fires

Step 3: Populate Name and Title details

• Choose the folder to which the alert definition should be saved. (If you need to create a separate folder, then create one using the “new folder” option in the drop-down menu).

• Rule Name: set a descriptive name for the rule.

• Group Name: Specify a group name. Rules within a group are run sequentially at regular intervals, with the same evaluation time.

• Populate title and summary with variables to include additional information in the alert.

Step 4: Configure a contact point

• Choose how notifications are sent to your teams (email, Slack, PagerDuty, etc). Choose an existing contact point from the drop-down menu for notifications when this alert fires, or create a new one. To configure a new contact point, please see details for each type of contact point in this section. Once done, click “Create Rule”