Simple Log Service:Alerts and tagging feedback

Procedure

1. In the Log Service console, configure DingTalk as the notification channel.

   Note

   If you already configured the DingTalk notification channel when you created the target intelligent inspection job, you can skip this step.

   1. Log on to the Simple Log Service console.

   2. In the Log Application section, click Intelligent Anomaly Analysis.

   3. Click real-time inspection.

   4. In the instance list, click the target instance.

   5. On the Intelligent Inspection page, find the target intelligent inspection job and click the icon in the Actions column.

   6. In the Modify Intelligent Inspection Job wizard, click Next until you reach the Alert Configuration tab.

   7. On the Alert Configuration tab, select Simple Mode, set Request URL, and then click Complete.

      For Request URL, enter the webhook URL of your DingTalk chatbot.

      Note

      The intelligent inspection feature includes a built-in alert template, SLS Anomaly Detection Content Template, that renders a time series chart and provides feedback options. DingTalk is recommended because it displays these alerts well. To use a different channel, see Configure other notification channels.

      The following figure shows an example of an alert configuration.

      Parameter	Description
      Alert Policy	An alert policy merges, silences, and suppresses alerts. If you select Simple Mode or standard mode, you do not need to configure an alert policy. Log Service uses the built-in dynamic alert policy (sls.builtin.dynamic) by default. If you select Advanced Mode, you can select a custom action policy and alert policy. For more information about how to create an alert policy, see Create an alert policy.
      Action Policy	An action policy controls the notification channels and frequency. When the Alert Policy is set to Simple Mode, you only need to configure the action group. After you configure the action group, Log Service automatically creates an action policy named Rule Name-Action Policy. This policy is used to send all alerts triggered by the rule. For more information, see Notification channels. Important You can modify this action policy on the Action Policy page. For more information, see Action policies. If you add conditions when you modify the action policy, the Alert Policy automatically changes to standard mode. If Alert Policy is set to standard mode or Advanced Mode, you can select a built-in or custom action policy for alert notifications. For more information about how to create an action policy, see Action policies. If Alert Policy is set to Advanced Mode, you can also enable or disable Custom Action Policy. For more information, see Dynamic action policy mechanism.

   After you complete the configuration, you will receive alert notifications in your DingTalk group.

2. In the DingTalk group, tag the alert notification.

   1. In the alert notification, click View Details.

      

      Parameter	Description
      Data Source	The data source of the intelligent inspection job.
      Anomaly Object	The entity where the anomaly occurred.
      Anomaly Severity	The anomaly severity as quantified by the model.
      Result visualization	The metric trend within the observation window before the anomaly was detected.
      Data Details	A link to the inspection data source.
      Job Details	A link to the details of the intelligent inspection job.
      View Details	View alert details without signing in to the console. For more information, see View alert details without signing in.

   2. In the Details dialog box, evaluate the alert and provide feedback by tagging it.

      • If the alert is expected, click Confirm.

      • If the alert is a false positive, click Ignore.

   After you tag an alert, the job uses your feedback to fine-tune its model, improving the accuracy of future alerts.

Configure other notification channels

To provide tagging feedback through other notification channels such as WebHook-Custom, select the desired channel when you configure the alert. For more information, see Notification channels. Before you switch channels, configure an alert template for the new channel:

1. Analyze the alert template for the DingTalk channel.

   The alert template for DingTalk is as follows:

   ## Data Source
   + Project: ${results[0].project}
   + LogStore: ${results[0].store}
   
   ## Anomaly Object
   + Entity: ${labels}
   
   ## Anomaly Score
   + Score: ${annotations.anomaly_score}
   
   ## Anomaly Time Series Chart
   ![image](${annotations.__plot_image__})
   
   [[Data Details](${query_url})]
   [[Job Details](${alert_url})]
   
   [[Confirm](${annotations.__ensure_url__})]
   [[False Positive](${annotations.__mismatch_url__})]

   For more information about the variables in the alert template, see Variables in alert templates (New version).

2. Configure an alert template for your desired notification channel based on the DingTalk template.

   In the list of alert templates, find SLS Anomaly Detection Content Template and modify it. For information about how to navigate to the alert template page, see Step 2.

   When you configure an alert template, you can use the default alert template or customize it. For more information, see Default content templates and Customize notification content.