This topic describes alarm log fields. Log Service automatically creates a Logstore to record the events related to alarms by using the form of logs.

Fields of alarm execution logs

Field name Description Example
AlertDisplayName The customized alarm name that is displayed in the console. alarm-01
AlertID The ID of a specific execution of an alarm. 0fdd88063a611aa114938f9371daeeb6-1671a52eb23
AlertName The unique alarm name generated by the system in a project. alert-1542111415-153472
Condition The condition for triggering an alarm. $0.count > 1
Dashboard The dashboard where an alarm is configured. my-dashboard
FireCount The number of times for which an alarm has been triggered after the last time when alarm notifications are sent. 1
Fired Indicates whether an alarm is triggered. Valid values: true | false. true
LastNotifiedAt The time when the most recent alarm notifications are sent. It is displayed as a Unix timestamp. 1542164541
NotifyStatus The alarm notification status.
  • Success: indicates that alarm notifications were sent successfully.
  • Failed: indicates that alarm notifications failed to be sent.
  • NotNotified: indicates that no notifications were sent.
  • PartialSuccess: indicates that only part of alarm notifications were sent successfully.
Success
Reason Causes for which the system failed to send alarm notifications or the system did not send alarm notifications as required. result type is not bool
Results The alarm log searching result, which includes the parameters used and the array type. For more information, see Result fields.
[
                                        {
                                        "EndTime": 1542334900,
                                        "FireResult": null,
                                        "LogStore": "test-logstore",
                                        "Query": "* | select count(1) as count",
                                        "RawResultCount": 1,
                                        "RawResults": [
                                        {
                                        "__time__": "1542334840",
                                        "count": "0"
                                        }
                                        ],
                                        "StartTime": 1542334840
                                        }
                                        ]
Status The alarm execution result. Valid values: Success | Failed. Success

Result fields

Field name Description Example
Query The query statement, which can be a search statement or a search-and-analysis statement. * | select count(1) as count
LogStore The target Logstore. my-logstore
StartTime The starting time of a search. 2019-01-02 15:04:05
StartTimeTs The starting time of a search (displayed as a Unix timestamp). 1542334840
EndTime The end time of a search. 2019-01-02 15:19:05
EndTimeTs The end time of a search (displayed as a Unix timestamp).
Note The time range of a search is between the StartTime and the EndTime.
1542334900
RawResults The raw results of a search, including the array type.
[
                                        {
                                        "__time__": "1542334840",
                                        "count": "0"
                                        }
                                        ]
RawResultsAsKv The formatted key-value raw logs that trigger an alarm.
Note This field can only be used as a template variable, and will not be stored in a Logstore.
[foo:0]
RawResultCount The number of the raw results. 1
FireResult The log of a triggered alarm. If no alarm is triggered, this field displays null.
{
                                        "__time__": "1542334840",
                                        "count": "0"
                                        }
FireResultAsKv The formatted key-value raw logs that trigger an alarm.
Note This field can only be used as a template variable, and will not be stored in a Logstore.
[foo:0]