ALIYUN::SLS::Alert is used to create an alert rule.

Syntax

{
  "Type": "ALIYUN::SLS::Alert",
  "Properties": {
    "Project": String,
    "Detail": Map
  }
}

Properties

Property Type Required Editable Description Constraint
Project String Yes No The name of the Log Service project. None
Detail Map Yes Yes The details of the alert rule. For more information, see Detail properties.

Detail syntax

"Detail": {
  "Type": String,
  "Description": String,
  "Configuration": Map,
  "State": String,
  "Schedule": Map,
  "DisplayName": String,
  "Name": String
}

Detail properties

Property Type Required Editable Description Constraint
Type String No No The type of the alert rule. None
Description String No Yes The description of the alert rule. None
Configuration Map Yes Yes The configurations of the alert rule. For more information, see Configuration properties.
State String No No Specifies whether to enable the alert rule. Valid values:
  • Enable
  • Disabled
Schedule Map Yes Yes The time interval at which Log Service evaluates the alert rule. If more than 100 log entries are returned when Log Service evaluates the alert rule, only the first 100 log entries are checked.

For more information, see Schedule properties.

DisplayName String Yes Yes The display name you specify for the alert rule. The name must be 1 to 64 characters in length.
Name String Yes No The name of the alert rule, which is generated by the system in the project. None

Configuration syntax

"Configuration": {
  "Throttling": String,
  "Condition": String,
  "NotificationList": List,
  "NotifyThreshold": Integer,
  "Dashboard": String,
  "QueryList": List
}

Configuration properties

Property Type Required Editable Description Constraint
Throttling String Yes Yes The interval at which Log Service sends alert notifications. None
Condition String Yes Yes The condition that is required to trigger an alert rule. The following operators are supported: plus (+), minus (-), multiplication (*), division (/), modulo (%), greater-than (>), greater-than-or-equal-to (>=), less-than (<), less-than-or-equal-to (<=), equal-to (==), not-equal-to (!=), match (=~), and not-match (!~).

For more information, see Syntax of trigger conditions in alert rules.

NotificationList List No Yes The list of one or more notifications. For more information, see NotificationList properties.
NotifyThreshold Integer No Yes The threshold for accumulated number of alert rule evaluations in which the trigger condition is met before alert notifications are sent. None
Dashboard String Yes Yes The dashboard with which the alert rule is associated. None
QueryList List Yes Yes The list of one or more queries. For more information, see QueryList properties.

NotificationList syntax

"NotificationList": [
  {
    "Type": String,
    "MobileList": List,
    "ServiceUri": String,
    "Content": String,
    "EmailList": List
  }
]

NotificationList properties

Property Type Required Editable Description Constraint
Type String Yes No The method of alert notification. Valid values:
  • Email: emails
  • MessageCenter: message center
  • DingTalk: DingTalk chatbot webhook
  • Webhook: custom webhook
Content String No No The content of the alert notification. You can use the following system variables in the content: ${Project}, ${Condition}, ${AlertName}, ${AlertID}, ${Dashboard}, ${FireTime}, ${Results}.

For more information, see Configure notification methods.

MobileList List No No The list of one or more phone numbers of the alert contact.

A mobile phone number receives a maximum of 50 text messages every day.
ServiceUri String No No The webhook URI. This parameter is required when the Type parameter is set to DingTalk or Webhook.
EmailList List No No The list of one or more email addresses that receive the alert notification. This parameter is required when the Type parameter is set to Email.

An email address receives a maximum of 100 emails every day.

QueryList syntax

"QueryList": [
  {
    "Query": String,
    "LogStore": String,
    "Start": String,
    "TimeSpanType": String,
    "End": String,
    "ChartTitle": String
  }
]

QueryList properties

Property Type Required Editable Description Constraint
Query String Yes No The query statement. None
LogStore String Yes No The Logstore for which the alert rule is created. None
Start String Yes No The start time of the time range to query. None
TimeSpanType String Yes No The time range to query. None
End String Yes No The end time of the time range to query. None
ChartTitle String Yes No The title of the chart. None

Schedule syntax

"Schedule": {
  "Type": String,
  "Interval": String,
  "Hour": Integer,
  "DayOfWeek": Integer,
  "CronExpression": String,
  "Delay": Integer,
  "RunImmediately": Boolean
}

Schedule properties

Property Type Required Editable Description Constraint
Type String Yes Yes The type of the schedule based on which the alert is triggered. Valid values:
  • Hourly: The alert is triggered on an hourly basis.
  • Daily: The alert is triggered on a daily basis.
  • Weekly: The alert is triggered on a weekly basis.
  • FixedRate: The alert is triggered on a regular basis.
  • Cron: The alert is triggered based on the specified CRON expression.
Interval String No Yes The schedule for triggering the alert on a regular basis. This parameter is required when the Type parameter is set to FixedRate.

Sample values:

  • 10d: The alert is triggered every ten days.
  • 10h: The alert is triggered every ten hours.
  • 10m: The alert is triggered every ten minutes.
Hour Integer No Yes The hour on which the alert is triggered. This parameter is required when the Type parameter is set to Daily or Weekly.

Valid values: 0 to 23.
DayOfWeek Integer No Yes The day of week when the alert is triggered. This parameter is required when the Type parameter is set to Weekly.

Valid values: 1 to 7.
CronExpression String No Yes The CRON expression based on which the alert is triggered. This parameter is required when the Type parameter is set to Cron.
RunImmediately Boolean No Yes Specifies whether to trigger the alert immediately. Valid values:
  • true
  • false
Delay Integer No Yes Specifies whether to delay triggering of the alert. None

Response parameters

Fn::GetAtt

Name: the name of the alert rule.

Example

JSON format 

{
  "ROSTemplateFormatVersion": "2015-09-01",
  "Parameters": {
    "Project": {
      "Type": "String",
      "Description": "Project name:\n1. Only supports lowercase letters, numbers, hyphens (-) and underscores (_).\n2. Must start and end with lowercase letters and numbers.\n3. The name length is 3-63 characters.",
      "AllowedPattern": "^[a-zA-Z0-9_-] $",
      "MinLength": 3,
      "MaxLength": 63
    },
    "Detail": {
      "Type": "Json",
      "Description": ""
    }
  },
  "Resources": {
    "Alert": {
      "Type": "ALIYUN::SLS::Alert",
      "Properties": {
        "Project": {
          "Ref": "Project"
        },
        "Detail": {
          "Ref": "Detail"
        }
      }
    }
  },
  "Outputs": {
    "Name": {
      "Description": "Alert name.",
      "Value": {
        "Fn::GetAtt": [
          "Alert",
          "Name"
        ]
      }
    }
  }
}

YAML format 

ROSTemplateFormatVersion: '2015-09-01'
Parameters:
  Project:
    Type: String
    Description: >-
      Project name:

      1. Only supports lowercase letters, numbers, hyphens (-) and underscores
      (_).

      2. Must start and end with lowercase letters and numbers.

      3. The name length is 3-63 characters.
    AllowedPattern: '^[a-zA-Z0-9_-] $'
    MinLength: 3
    MaxLength: 63
  Detail:
    Type: Json
    Description: ''
Resources:
  Alert:
    Type: 'ALIYUN::SLS::Alert'
    Properties:
      Project:
        Ref: Project
      Detail:
        Ref: Detail
Outputs:
  Name:
    Description: Alert name.
    Value:
      'Fn::GetAtt':
        - Alert
        - Name