In an alert monitoring rule, the execution result of an evaluate expression is used to check whether the condition to trigger an alert is met and evaluate the dynamic severity of the alert. The results of query statements are input, and the fields in the result of set operations are variables. If an evaluate expression returns true, and the number of consecutive times that the trigger condition is met reaches the value of the Threshold of Continuous Triggers parameter, an alert is triggered. This topic describes how to use evaluate expressions.
Limits
Evaluate expressions that can be specified in an alert monitoring rule have the following limits:
Negative numbers must be enclosed in parentheses (). Example:
x+(-100)<100.Numeric values are converted to 64-bit floating-point numbers. If the numbers are used in comparison, errors may occur. For example, you can compare two numbers to check whether they are equal.
Variable names can contain only letters and digits, and must start with a letter.
An evaluate expression must be 1 to 128 characters in length.
An alert is triggered only when an evaluate expression returns true, and the number of consecutive times that the trigger condition is met reaches the value of the Threshold of Continuous Triggers parameter. For example, if an evaluate expression is
100+100, the calculation result is 200, which is not the value true. In this case, no alert is triggered.true, false, dollar sign ($), and period (.) are reserved words for evaluate expressions. The reserved words cannot be used as variables.
Syntax
The following table describes the types of syntax that are supported by the evaluate expressions of an alert monitoring rule.
Syntax type | Description | Example |
Arithmetic operators | The following arithmetic operators are supported: addition (+), subtraction (-), multiplication (*), division (/), and modulus (%). |
|
Comparison operators | The following comparison operators are supported: greater-than (>), greater-than-or-equal-to (>=), less-than (<), less-than-or-equal-to (<=), equal-to (==), not-equal-to (!=), regex match (=~), and regex not match (!~). Note
|
|
Logical operators | The AND (&&) and OR (||) operators are supported. |
|
Not operator | The not operator (!) is supported. |
|
Numeric constants | Numeric constants are supported. Simple Log Service converts numeric constants to 64-bit floating-point numbers for processing. |
|
String constants | String constants are supported. The string constants are in the format of 'String'. Example: 'String'. |
|
Boolean constants | Boolean constants are supported. Valid values: true and false. |
|
Parentheses | Parentheses () can be used to override the standard precedence order in calculation. |
|
contains function | The contains function can be used to check whether a string contains a substring. For example, if you invoke |
|
Special field names | Field names are the names of the fields that are returned in a result set. We recommend that you use strings as field names. A field name that contains only digits or contains special characters is not recommended. Special characters include percent sign (%). If a field name contains special characters or only digits, the field name must be enclosed in brackets []. |
|
Evaluate the results of set operations
Simple Log Service supports associated monitoring for up to three data sets and evaluates the results of set operations. For more information, see Multi-set operations.
You can use dynamic variables in an evaluate expression. For more information, see Use an evaluate expression to specify a trigger condition.
Operation methods
Simple Log Service converts all numeric values to 64-bit floating-point numbers.
A string constant must be enclosed in single quotation marks ('') or double quotation marks (""). Examples:
'String'and"String".Boolean values are true and false.
Operator | Operation method | ||
Operation between variables | Operation between a non-string constant and a variable | Operation between a string constant and a variable | |
Arithmetic operators: addition (+), subtraction (-), multiplication (*), division (/), and modulus (%) | Before an arithmetic operator is applied, the left and right operands are converted to 64-bit floating-point numbers. | Before an arithmetic operator is applied, the left and right operands are converted to 64-bit floating-point numbers. | Not supported. |
Comparison operators: greater-than (>), greater-than-or-equal-to (>=), less-than (<), less-than-or-equal-to (<=), equal-to (==), and not-equal-to (!=) | Simple Log Service uses the following comparison rules that are sorted in the precedence order:
| The left and right operands are converted to 64-bit floating-point numbers and then compared based on the numerical order. | The left and right operands are converted to strings and then compared based on the alphabetical order. |
Regular expression operators: regex match (=~) and regex not match (!~) | Before a regular expression operator is applied, the left and right operands are converted to strings. | Not supported. | Before a regular expression operator is applied, the left and right operands are converted to strings. |
Logical operators: AND (&&) and OR (||) | The left and right operands must be sub-expressions, and the result of the operation must be a Boolean value. For example, the evaluate expression is | The left and right operands must be sub-expressions, and the result of the operation must be a Boolean value. For example, the evaluate expression is | The left and right operands must be sub-expressions, and the result of the operation must be a Boolean value. For example, the evaluate expression is |
Not operator (!) | The required operand must be a sub-expression, and the result of the operation must be a Boolean value. For example, the evaluate expression is This operator cannot be directly used for the fields in the result of set operations. | The required operand must be a sub-expression, and the result of the operation must be a Boolean value. For example, the evaluate expression is This operator cannot be directly used for the fields in the result of set operations. | The required operand must be a sub-expression, and the result of the operation must be a Boolean value. For example, the evaluate expression is This operator cannot be directly used for the fields in the result of set operations. |
contains function | Before the contains function is run, the left and right operands are converted to strings. | Not supported. | Before the contains function is run, the left and right operands are converted to strings. |
Parentheses () | Parentheses () are used to override the standard precedence order in calculation. | Parentheses () are used to override the standard precedence order in calculation. | Parentheses () are used to override the standard precedence order in calculation. |
Examples
Example 1: If the request success rate is less than 90%, and the average response time of requests is longer than 60 seconds in a 15-minute period, an alert is triggered. The evaluate expression is
$0.success_ratio < 90 && $1. Average response time \(s\) > 60. The following figure shows the configuration.
Example 2: If the number of times that the HTTP status code 500 is returned exceeds 10 in a 15-minute period, an alert is triggered. The evaluate expression is
status == 500 && total > 10. The following figure shows the configuration.