Log Service supports static settings and dynamic settings for alert severities. If you do not specify an evaluation condition when you set the Severity parameter, the setting of the alert severity is static. If you specify an evaluation condition when you set the Severity parameter, the settings of the alert severities are dynamic.

- Query Statistics: Enter
host:www.example.com and status = 500 | select coalesce(diff[2],0) as ratio from (select compare(cnt,86400) as diff from (select count(1) as cnt from log))
.This query statement is used to calculate the ratio of 500 error responses on a specified website in the current 15 minutes to 500 error responses on the same website in the same time range of the previous day.
- Trigger Condition:
- Select data matches the expression and enter ratio>1. Set Severity to Critical.
If the value of a ratio field in the query and analysis result is greater than 1, an alert of the Critical severity level is triggered.
- Select data matches the expression and enter ratio>=0.5. Set Severity to High.
If the value of a ratio field in the query and analysis result is greater than or equal to 0.5, an alert of the High severity level is triggered.
- Select data matches the expression and enter ratio>0.05. Set Severity to Medium.
If the value of a ratio field in the query and analysis result is greater than 0.05, an alert of the Medium severity level is triggered.
- Select data matches the expression and enter ratio>1. Set Severity to Critical.