All Products
Search

This Product

    Microservices Engine:Set up traffic protection alerts with Simple Log Service

    Document Center

    Microservices Engine:Set up traffic protection alerts with Simple Log Service

    Last Updated:Mar 11, 2026

    When Microservices Engine (MSE) throttles or circuit-breaks requests, your operations team needs to know immediately. After you report MSE traffic protection events to Simple Log Service (SLS), configure alert rules to automatically notify your team. This helps them respond before application stability is affected.

    How it works

    MSE logs each throttling or circuit breaking event and sends it to an SLS Logstore. An SLS alert monitoring rule periodically queries these logs. When the query returns results that match your trigger condition, SLS sends a notification through the channel you configure.

    MSE traffic protection event --> SLS Logstore --> Alert monitoring rule --> Notification

    Each traffic protection log entry contains the following fields. Understanding these fields helps you write effective alert queries and design useful notification templates.

    FieldDescriptionExample values
    resourceThe protected API endpoint or interfacecom.example.service.UserAPI
    expTypeThe type of protection that triggeredThrottling, circuit breaking
    ruleIdThe ID of the traffic protection rule that matched12345
    blockNumThe number of requests blocked per second (blocked QPS)61
    timeThe timestamp when the protection event occurred2024-06-20 16:35:10
    appNameThe name of the application where the event occurredorder-service
    namespaceThe environment or namespace of the applicationproduction

    Prerequisites

    Before you begin, make sure that you have:

    Create an alert monitoring rule

    The following steps cover the main configuration. For all available options, see Configure an alert monitoring rule in Simple Log Service.

    Step 1: Define the alert query

    1. Log on to the Simple Log Service console.

    2. Select the project that you created or used in Report MSE traffic protection events to Simple Log Service.

    3. In the left-side navigation pane, click the Logstores icon icon to go to the Logstores page.

    4. Click the target Logstore, then click the Alert icon icon in the upper-right corner.

      Save as alert

    5. In the Alert Monitoring Rule panel, click the Query Statistics icon icon next to Query Statistics and enter the following query in the Query field:

      * | select resource,expType,ruleId,blockNum,time,appName,namespace

      This query retrieves all traffic protection events with their fields: the protected endpoint, protection type, matched rule, blocked QPS, timestamp, application name, and namespace.

    Step 2: Set the alert destination and policy

    1. Set Destination to Simple Log Service Notification and turn on the Enable switch.

    2. Set Alert Policy to Simple Mode and configure the alert policy.

    After you save the rule, it appears in Alert Center.

    Customize the notification template

    Define what information appears in the alert notification when a traffic protection event triggers it.

    1. In the left-side navigation pane, click the Alert icon icon to go to Alert Center.

    2. Click the Notification Policy tab, then click the Alert Template subtab.

    3. Click Create. In the Add Alert Template dialog box, configure the ID, Name, and Content parameters.

    The following sections provide two template options depending on how many events you want to display.

    First triggered event only

    Use this template to display details of the first event that triggered the alert:

    - Alert name: {{ alert.alert_name }}
- Alert severity: {{ alert.severity }}
- Trigger condition: {{ alert.condition }}
- Environment: {{ alert.annotations.namespace }}
- Application: {{ alert.annotations.appName }}
- Interface: {{ alert.annotations.resource }}
- Type: {{ alert.annotations.expType }}
- Hit rule: {{ alert.annotations.ruleId }}
- QPS for throttling: {{alert.annotations.blockNum}}
- Hit time: {{ alert.annotations.time }}

- Details: [[Details]({{ alert.query_url }})]

    All triggered events

    Use this template to display details of every event that triggered the alert within the evaluation window. This option works well when multiple traffic protection rules fire simultaneously across different services.

    - Alert name: {{ alert.alert_name }}
- Alert severity: {{ alert.severity }}
- Trigger condition: {{ alert.condition }}

{%- for result in alert.fire_results %}
- Application: {{ result.appName }}
- Interface: {{ result.resource }}
- Type: {{ result.expType }}
- Hit rule: {{ result.ruleId }}
- QPS for throttling: {{result.blockNum}}
- Hit time: {{ result.time }}
{%- endfor %}
- Details: [[Details]({{ alert.query_url }})]

    Verify the alert

    After you save the alert monitoring rule and notification template:

    1. In Alert Center, confirm the new rule appears in the rule list.

    2. Trigger a traffic protection event (or wait for one to occur naturally) and check that the alert notification is delivered with the expected content.

    References