Configure alert rules

• If you have high requirements for alert accuracy, such as no duplicate alerts and no missing alerts, you can set the time range to an earlier period. For example, if the alert rule is executed at 12:03:30, you can set the time range to [12:02:20,12:03:20) that is 10 seconds earlier. This prevents missing alerts that are caused by indexing latency.
• If you have high requirements for real-time performance, we recommend that you set the time range to a period whose start time is earlier than the time when the alert rule is executed. This allows you to receive alert notifications when alerts are triggered regardless of duplicate alerts. For example, if the alert rule is executed at 12:03:30, you can set the time range to [12:02:20,12:03:30).

• If you have high requirements for alert accuracy, such as no duplicate alerts and no missing alerts, you can set the time range to a time frame. You can set the time range to 1 Minute(Time Frame), 5 Minutes(Time Frame), or 1 Hour(Time Frame). Then, you can set the Check Frequency parameter to the same time period, for example, 1 Minutes, 5 Minutes, or 1 Hours.
• If you have high requirements for real-time performance, we recommend that you set the time range to a specific period. The specific period must include at least the minute before the current time. This allows you to receive alert notifications when alerts are triggered regardless of duplicate alerts. For example, the alert rule is executed at 12:03:30. If you set the time range to 90 Minutes(Relative), this indicates that the time range is [12:02:00,12:03:30). Then, you can set the Check Frequency parameter to Fixed Interval 1 Minutes.

For example, you can configure an alert rule to trigger an alert when the number of log entries whose log level is ERROR reaches a specified threshold. You also want to receive an alert notification that contains the logs whose log level is ERROR. You can configure the alert rule as shown in the following figure. For more information, see Configure an alert rule.

${results[1].RawResultsAsKv}

An alert is triggered only when the specified trigger condition is met during continuous check periods.

For example, the Check Frequency parameter is set to Fixed Interval 1 Minutes and the Trigger Threshold parameter is set to 5. In this case, an alert notification is sent only when the specified trigger condition is met for five times during five continuous check periods. If the trigger condition is not met, no alert is triggered.

If the check frequency is set to a short interval, you can set the Notification Interval parameter to specify the minimum interval at which alert notifications are sent. This prevents frequent alert notifications. For example, the Check Frequency parameter is set to Fixed Interval 1 Minutes and the Notification Interval parameter is set to 30Minutes. In this case, no alert notification is sent within 30 minutes after the previous alert notification is sent even if an alert is triggered.

• Fields of the array type are referenced in the ${fieldName[{index}]} format. {index} indicates an array subscript that starts from 0. For example, ${results[0]} indicates that the first element in the Results array is referenced.
• Fields of the object type are referenced in the ${object.key} format. For example, ${results[0].StartTimeTs} indicates a timestamp of 1542453580.

{
  "EndTime": "2006-01-02 15:04:05",
  "EndTimeTs": 1542507580,
  "FireResult": {
    "__time__": "1542453580",
    "field": "value1",
    "count": "100"
  },
  "FireResultAsKv": "[field:value1,count:100]",
  "Truncated": false,
  "LogStore": "test-logstore",
  "Query": "* | SELECT field, count(1) group by field",
  "QueryUrl": "http://xxxx",
  "RawResultCount": 2,
  "RawResults": [
    {
      "__time__": "1542453580",
      "field": "value1",
      "count": "100"
    },
    {
      "__time__": "1542453580",
      "field": "value2",
      "count": "20"
    }
  ],
  "RawResultsAsKv": "[field:value1,count:100],[field:value2,count:20]",
  "StartTime": "2006-01-02 15:04:05",
  "StartTimeTs": 1542453580
}