You can create an alert rule on the Search & Analysis page of a Logstore or on a dashboard page in the Log Service console. After you create an alert rule, Log Service sends alert notifications when the trigger condition in the alert rule is met.

Prerequisites

  • Logs are collected and stored in a Logstore.
  • The indexing feature is enabled and indexes are configured. For more information, see Configure indexes.

Background information

Log Service allows you to configure alerts based on charts. You can create an alert rule for a query statement on the Search & Analysis page. After you create the alert rule, a chart that shows the query result of the statement is automatically created in the specified dashboard. You can also create an alert rule for one or more existing charts in a dashboard.
Notice If you modify the query statement of a chart with which an alert rule is associated, you must update the query statement in the alert rule. For more information, see Modify the configurations of an alert rule.
  • Create a chart and configure an alert rule for the chart
    After you create an alert rule for a query statement, a chart that shows the query result of the query statement is automatically created in the specified dashboard. Therefore, when you create an alert rule for a query statement, you must specify a dashboard and name the chart. Create an alert rule for a query statement
  • Create an alert rule for existing charts on a dashboard
    When you create an alert rule for existing charts, you can specify one or more charts with which you want to associate the alert rule. You can then specify a conditional expression for each chart, and then combine the conditional expressions into a trigger condition of the alert rule. Create an alert rule for existing charts on a dashboard

Procedure

  1. Log on to the Log Service console.
  2. In the Projects section, click the name of the project that you want to view.
  3. In the left-side navigation pane, click Dashboard.
  4. In the Dashboard list, click the dashboard for which you want to configure alert rules.
  5. On the Dashboard page, choose Alerts > Create Old Version Alert.
  6. In the Alert Configuration step, set the required parameters and click Next. The following table describes the parameters.
    Parameter Description
    Alert Name The name of the alert rule. The name must be 4 to 64 characters in length.
    Associated Chart The chart with which you want to associate the alert rule.

    Log Service allows you to add up to three charts. You can configure an alert rule for up to three query statements at the same time. The number before the chart name is the serial number of the chart. The serial number of the chart is valid in the alert rule. You can use the serial number to specify a chart in the Trigger Condition parameter.

    The Search Period parameter specifies the time range of each query. For example, if the current time is 14:30:06. and you set the Search Period parameter to 1 Hour(Relative), the time range of the query is 13:30:06-14:30:06.

    You can click the Edit icon next to the Query field to modify the query statement. For more information about how to specify a query statement, see Log analysis overview.

    Frequency The frequency at which query results are checked.
    • Hourly: Query results are checked every hour.
    • Daily: Query results are checked at a specified time every day.
    • Weekly: Query results are checked at a specified time on a specified day of every week.
    • Fixed Interval: Query results are checked at a specified interval.
    • Cron: Query results are checked at an interval that is specified by using a CRON expression.

      If you use CRON expressions, the minimum precision is 1 minute. The time format is based on the 24-hour clock. For example, 0 0/1 * * * indicates that query results are checked every hour from 00:00.

    Note If a query returns more than 100 log entries, Log Service checks only the first 100 log entries from the result.
    Trigger Condition The trigger condition of an alert. If the specified trigger condition is met, an alert is triggered. For more information, see Syntax of trigger conditions in alert rules.

    You must separate multiple conditions with two ampersands (&&), for example, pv%100 > 0 && uv > 0.

    You can use $serial number to specify a chart. For example, the trigger condition is set to $0.pv>1000&&$1.pv>1000. In the trigger condition, $0 indicates chart 0, and $1 indicates chart 1. For more information, see How can I view the serial number of a chart?

    Notification Trigger Threshold An alert is triggered only when the specified trigger condition is met during continuous check periods. If the number of continuous triggers reaches the specified threshold, alert notifications are sent at the specified notification interval. If the trigger condition is not met, no alert is triggered.

    Default value: 1. This value indicates that alert notifications are sent if the trigger condition is met.

    You can set the Notification Trigger Threshold parameter to an integer that is greater than 1. In this case, alert notifications are sent only when the number of continuous triggers reaches the threshold. For example, the Notification Trigger Threshold parameter is set to 100. If the trigger condition is met for 100 times during continuous check periods, the value of Notification Trigger Threshold is reached. In this case, if the interval between the current time and the last time when alert notifications are sent exceeds the specified value of the Notification Interval parameter, an alert notification is sent. After an alert notification is sent, Log Service resets the number of continuous triggers to zero. A check may fail due to network exceptions. In this case, the check is not counted.

    Notification Interval The interval at which Log Service sends alert notifications.

    If the trigger condition is met in a check, Log Service checks whether the number of continuous triggers reaches the specified value of the Notification Trigger Threshold parameter. Log Service also checks whether the interval between the current time and the last time when alert notifications are sent exceeds the specified value of the Notification Interval parameter. If you set the Notification Interval parameter to 5 minutes, only one alert notification is received once every five minutes.

    Note You can use the Notification Trigger Threshold parameter and the Notification Interval parameter to control the number of alert notifications that you receive.
  7. In the Notifications step, configure notification methods and click Submit.
    Log Service supports notification methods such as emails, DingTalk chatbot webhooks, custom webhooks, and Alibaba Cloud Message Center. To configure a notification method, you can select a notification method, click Add, and then set the parameters. You can configure one or more notification methods. You can also click Import Notification Configurations to inherit the notification methods of an existing alert rule. For more information, see Configure notification methods.

FAQ

How can I view the serial number of a chart?

You can view the serial number of a chart in the Associated Chart section. The first chart is numbered 0, the second chart is numbered 1, and the third chart is numbered 2. The serial number of a query statement is the same as the serial number of the chart that shows the result of the query statement. View the serial number of a chart

What to do next

After you create an alert rule, you can manage the alert rule and view the alerts that are triggered based on the alert rule. For more information, see View the evaluation results of alert rules.