Simple Log Service:Data structure of an alert rule

Field

Type

Required

Description

name

String

Yes

Alert rule ID, displayed in the URL.

displayName

String

Yes

Alert rule name, displayed in the alert list.

status

String

No

The status of the alert rule. Valid values:

• Enabled (default)

• Disabled

type

String

Yes

Fixed value: Alert.

description

String

No

Compatibility field. Set to an empty string.

schedule

Schedule

Yes

The check frequency-related settings. For more information, see Schedule.

configuration

Configuration

Yes

The detailed settings of the alert rule. For more information, see Configuration.

Field

Type

Required

Description

type

String

Yes

Check frequency type. Valid values:

• FixedRate: Fixed interval.

• Cron: Interval specified by a cron expression.

• Weekly: Specified day and time each week.

• Daily: Specified time each day.

• Hourly: Every hour.

interval

String

No

The fixed interval. Examples: 5m and 1h.

If you set type to FixedRate, you must configure interval.

cronExpression

String

No

Cron expression for minute-level intervals, based on the 24-hour clock. Example: 0 0/1 * * * checks every hour from 00:00.

If you set type to Cron, you must configure cronExpression.

dayOfWeek

Integer

No

The day of the week. Valid values: 0 to 6, which specify Sunday to Saturday.

If you set type to Weekly, you must configure dayOfWeek.

hour

Integer

No

The hour. Valid values: 0 to 23, which specify each hour in a day.

If you set type to Weekly or Daily, you must configure hour.

runImmediately

Boolean

No

Whether to run the rule immediately after creation.

Field

Type

Required

Description

version

String

Yes

Fixed value: 2.0.

type

String

Yes

Fixed value: default.

dashboard

String

No

The alert history dashboard. Recommended value: internal-alert-analysis.

queryList

AlertQuery

Yes

The list of query statements.

groupConfiguration

GroupConfiguration

Yes

Group evaluation settings. GroupConfiguration.

joinConfigurations

[]JoinConfiguration

No

Set operation settings. JoinConfiguration.

• If you specify only one query statement in queryList, you do not need to configure joinConfigurations.

• If you specify two to three query statements in queryList, you must configure joinConfigurations to associate the results of the query statements. For more information, see Configure a query statement.

severityConfigurations

[]SeverityConfiguration

Yes

Trigger conditions. Specify at least one. SeverityConfigurations.

labels

[]Tag

No

Labels. Tag.

annotations

[]Tag

No

Annotations. Tag.

autoAnnotation

Boolean

Yes

Whether to auto-add annotations.

• true (default): Auto-adds annotations such as __count__ to alerts. For more information, see Automatic annotations.

• false: No auto-annotations.

sendResolved

Boolean

No

Whether to send a recovery alert when an alert is cleared.

• true: Sends a recovery alert when an alert is cleared. For more information, see Set up recovery notifications.

• false (default): No recovery alerts.

threshold

Integer

Yes

Consecutive trigger count threshold. An alert fires when the trigger condition is met this many consecutive times. The system does not count the number of times when the specified trigger condition is not met.

noDataFire

Boolean

No

Whether to trigger an alert on no data.

• true: Triggers an alert when the number of times that no data is returned exceeds the value of Threshold of Continuous Triggers. For multiple queries, the count is based on set operation results. For more information, see No-data alert.

• false (default): No alert on no data.

noDataSeverity

Integer

No

Alert severity for no-data alerts. Alert severities.

policyConfiguration

PolicyConfiguration

Yes

Alert policy settings. PolicyConfiguration.

tags

[]String

No

The type of the custom alert rule.

Field

Type

Required

Description

storeType

String

Yes

Query data source type. Valid values:

• log: Logstore data

• metric: Metricstore data

• meta: resource data

region

String

Yes

The region of the project in which the query is performed.

• If you set storeType to log or metric, set region to the region of the project.

• If you set storeType to meta, set project to an empty string.

project

String

Yes

The project in which the query is performed.

• If you set storeType to log or metric, set project to the project.

• If you set storeType to meta, set project to an empty string.

store

String

Yes

The Logstore, Metricstore, or resource data on which the query is performed.

• If you set storeType to log, set store to the name of the Logstore.

• If you set storeType to metric, set store to the name of the Metricstore.

• If you set storeType to meta, set store to the name of the resource data.

roleArn

String

No

Alibaba Cloud Resource Name (ARN) of the RAM role for data access. For more information, see Configure authorization for data monitoring across projects.

query

String

Yes

The query statement.

• If you set storeType to log or metric, set query to the query statement.

• If you set storeType to meta, set project to an empty string.

timeSpanType

String

No

Time range type. Time ranges of query statements.

If you set storeType to log or metric, you must configure timeSpanType.

start

String

No

The start time.

If you set storeType to log or metric, you must configure start.

end

String

No

The end time.

If you set storeType to log or metric, you must configure end.

powerSqlMode

String

No

Whether to enable Dedicated SQL. Valid values:

• auto: The system automatically enables or disables Dedicated SQL.

• enable: Dedicated SQL is enabled.

• disable: Dedicated SQL is disabled.

Field

Type

Required

Description

type

String

Yes

Group evaluation type. Valid values:

• no_group: No grouping.

• custom: Group by a specified custom field.

• labels_auto: Auto-group.

  Metrics only.

fields

[]String

No

Field to group results by.

If you set type to custom, you must configure fields.

Field

Type

Required

Description

type

String

Yes

Set operation type. Valid values:

• cross_join: Cartesian product.

• inner_join: inner join.

• left_join: left join.

• right_join: right join.

• full_join: full join.

• left_exclude: left exclusion.

• right_exclude: right exclusion.

• concat: concatenation. The system traverses all datasets in sequence.

• no_join: no join. The system uses only the first dataset.

condition

String

No

If you set type to inner_join, left_join, right_join, full_join, left_exclude, or right_exclude, you must configure condition. Example: $0.host == $1.ip.

Field

Type

Required

Description

severity

Integer

Yes

Alert severity level. Alert severities.

evalCondition

ConditionConfiguration

No

The trigger condition. For more information, see Specify evaluate expressions.

evalCondition.condition

String

Yes

Data matching expression.

• If you do not need to match data, set the value to an empty string.

• In other scenarios, set the value to an expression. Example: errCnt > 10.

evalCondition.countCondition

String

Yes

Expression to match the data entry count.

• If you want the trigger condition to be met when data is returned in query and analysis results, set the value to an empty string.

• In other scenarios, set the value to an expression. Example: __count__ > 3.

Field

Type

Required

Description

key

String

Yes

The name of the field.

value

String

Yes

The value of the field.

Field

Type

Required

Description

alertPolicyId

String

Yes

Alert policy ID.

• In simple or standard mode, set the value to sls.builtin.dynamic, which is a built-in dynamic alert policy.

• In advanced mode, set the value to the ID of the alert policy.

actionPolicyId

String

Yes

Action policy ID.

In advanced mode, if the alert policy does not use a dynamic action policy, set actionPolicyId to an empty string.

repeatInterval

String

Yes

The repeat interval. Examples: 5m and 1h.

useDefault

Boolean

Yes

Compatibility field. Set to false.

Alert severity

Description

Critical

10

High

8

Medium

6

Low

4

Report

2

timeSpanType

start

end

Description

Custom

-15m

absolute

A 15-minute period of the Time Frame type.

Custom

-100s

-20s

A period of the Relative type that starts at the previous 100 seconds and ends at the previous 20 seconds.

Custom

-60s

now

A 60-second period of the Relative type.

Custom

-120m

Empty string

A 120-minute period of the Relative type.

Relative

-100s

-20s

A period of the Relative type that starts at the previous 100 seconds and ends at the previous 20 seconds.

Relative

-60s

now

A 60-second period of the Relative type.

Relative

-120m

Empty string

A 120-minute period of the Relative type.

Truncated

-15m

Arbitrary

A 15-minute period of the Time Frame type.

Today

Arbitrary

Arbitrary

A period that starts from 00:00 on the current day and ends at the current time.

Yesterday

Arbitrary

Arbitrary

A period that starts from 00:00 on the previous day and ends at 00:00 on the current day.