How to use evaluate expressions - Simple Log Service - Alibaba Cloud Documentation Center

In an alert rule, evaluate expressions determine whether the condition to trigger an alert is met and assess the dynamic severity of the alert.

Overview

The results of query statements serve as input, with fields from set operation results used as variables. If the evaluate expression returns true, an alert is triggered.

Limits

Evaluate expressions in alert rules have the following limits:

Negative numbers must be enclosed in parentheses (). Example: x+(-100)<100.
Numeric values are converted to 64-bit floating-point numbers. If used in comparisons such as equality checks, errors may occur.
Variable names can contain only letters and digits, and must start with a letter.
An evaluate expression must be 1 to 128 characters in length.
An alert is triggered only when an evaluate expression returns true and the number of consecutive times that the trigger condition is met reaches the value of the Threshold of Continuous Triggers parameter. For example, if an evaluate expression is 100+100, the calculation result is 200, which is not the value true. In this case, no alert is triggered.
true, false, dollar sign ($), and period (.) are reserved words for evaluate expressions. You cannot use the reserved words as variables.

Syntax

The following table describes the syntax types supported by evaluate expressions.

Note

Field names refer to the fields returned in a result set. Use strings as field names. Avoid field names that contain only digits or special characters such as the percent sign (%). If a field name contains special characters or only digits, enclose it in brackets []. Examples:

[5xx percentage (%)] > 20
[404] > 20

Syntax type	Operator	Operation method			Example
Syntax type	Operator	Operation between variables	Operation between a non-string constant and a variable	Operation between a string constant and a variable	Example
Arithmetic operators	addition (+), subtraction (-), multiplication (*), division (/), and modulus (%)	Before an arithmetic operator is applied, the left and right operands are converted to 64-bit floating-point numbers.	Before an arithmetic operator is applied, the left and right operands are converted to 64-bit floating-point numbers.	Not supported.	`x * 100 + y > 200` `x % 10 > 5`
Comparison operators	Comparison operators: greater-than (>), greater-than-or-equal-to (>=), less-than (<), less-than-or-equal-to (<=), equal-to (==), and not-equal-to (!=)	Simple Log Service applies the following comparison rules in precedence order: The left and right operands are converted to 64-bit floating-point numbers and then compared based on the numerical order. If the conversion fails, the rule of the following priority is applied. The left and right operands are converted to strings and then compared based on the alphabetical order.	The left and right operands are converted to 64-bit floating-point numbers and then compared.	The left and right operands are converted to strings and then compared based on the alphabetical order.	`x >= 0` `x < 100` `x <= 100` `x == 100` `x == "foo"` `(x > 100) == true` Note Boolean constants are supported.
Comparison operators	Regular expression operators: regex match (=~) and regex not match (!~) Note Backslashes (\) must be escaped. The Regular Expression 2 (RE2) syntax is used. For more information, see Syntax.	Before a regular expression operator is applied, the left and right operands are converted to strings.	Not supported.	Before a regular expression operator is applied, the left and right operands are converted to strings.	Regex match: `x =~ "\\w+"`.
Logical operators	Logical operators: AND (&&) and OR (\|\|)	The left and right operands must be sub-expressions, and the result of the operation must be a Boolean value. For example, the evaluate expression is `$0.success_ratio < 90 && $1.Average response time > 60`.	The left and right operands must be sub-expressions, and the result of the operation must be a Boolean value. For example, the evaluate expression is `$0.success_ratio < 90 && $1.Average response time > 60`.	The left and right operands must be sub-expressions, and the result of the operation must be a Boolean value. For example, the evaluate expression is `$0.success_ratio < 90 && $1.Average response time > 60`.	`x >= 0 && y <= 100` `x > 0 \|\| y >0`
Not operator	Not operator (!)	The required operand must be a sub-expression, and the result of the operation must be a Boolean value. For example, the evaluate expression is `!($0.success_ratio < 90)`. You cannot directly use this operator for the fields in the results of set operations.	The required operand must be a sub-expression, and the result of the operation must be a Boolean value. For example, the evaluate expression is `!($0.success_ratio < 90)`. You cannot directly use this operator for the fields in the results of set operations.	The required operand must be a sub-expression, and the result of the operation must be a Boolean value. For example, the evaluate expression is `!($0.success_ratio < 90)`. You cannot directly use this operator for the fields in the results of set operations.	`!(a < 1 && a > 100)`
contains function	contains function	Before the contains function is run, the left and right operands are converted to strings.	Not supported.	Before the contains function is run, the left and right operands are converted to strings.	`contains(foo, 'hello')`: If true is returned, the foo string contains the hello substring.
Parentheses	Parentheses ()	Parentheses () are used to override the standard precedence order in calculation.	Parentheses () are used to override the standard precedence order in calculation.	Parentheses () are used to override the standard precedence order in calculation.	`x * (y + 100) > 100`

Evaluate the results of set operations

Simple Log Service supports associated monitoring for up to three data sets and evaluates the results of set operations.

Results of set operations

Query statement results serve as input, and fields from set operation results serve as variables to evaluate whether to trigger an alert. For more information about set operations, see Correlating multiple query analysis results. The following table describes the results of set operations.

Note

Set operations such as CROSS JOIN and LEFT JOIN are performed on query and analysis results.

If query and analysis results do not contain duplicate fields, you can reference fields in an evaluate expression without the need to add prefixes to the fields. The prefixes include $0, $1, and $2. Example: name == 'sls'.
If query and analysis results contain duplicate fields, you can reference fields in an evaluate expression by adding prefixes to the fields. The prefixes include $0, $1, and $2. Example: $0.name == 'sls' || $1.name == 'ecs'.

Category	Subcategory	Description
Log	A query statement that does not contain SELECT	Only a search statement is used to query logs. When you specify an evaluate expression for a trigger condition, you can reference the fields that are contained in the query results.
	A query statement that contains SELECT * FROM log	When you specify an evaluate expression for a trigger condition, you can reference the fields for which Enable Analytics is turned on.
	A query statement that contains SELECT * FROM (SELECT...)	When you specify an evaluate expression for a trigger condition, you can reference the fields that are contained in the specified SELECT subquery.
Metric	A query statement that contains SELECT promql(...)	The promql_query(string) and promql_query_range(string, string) functions can always return the following fields: metric, labels, time, and value. Simple Log Service expands the labels field in the map format. When you specify an evaluate expression for a trigger condition, you can reference the following fields: metric, labels, time, and value. You can also reference the subfields of the labels field.
	A query statement that contains SELECT a, b FROM (SELECT promql(...))	When you specify an evaluate expression for a trigger condition, you can reference the fields for which Enable Analytics is turned on.
	A query statement that contains SELECT * FROM log	When you specify an evaluate expression for a trigger condition, you can reference the fields for which Enable Analytics is turned on.
Resource data	None	The value of a field in resource data can be of the string, floating-point number, or numeric type. The JSON type is not supported. When you specify an evaluate expression for a trigger condition, you can reference the ID of a field in resource data.

Configure a trigger condition

The evaluate expression evaluates the results of set operations. If it returns true, an alert is triggered. The following trigger condition types are supported:

Data is returned: Checks the number of rows in the set operation result. The condition is met if at least one row is returned.
The query result contains: Checks the number of rows in the set operation result. Supported operators include greater than, less than, and equal to. The condition is met if the number of rows satisfies the specified condition. For example, if the result set contains 4 rows and the trigger condition is The query result contains > 10, the condition is not met and no alert is generated.
Data matches the expression: Checks the content of the rows in the set operation result. The condition is met if the content of at least one row matches the evaluate expression. For example, if the result set contains one row (pv=900) and the trigger condition is Data matches the expression, pv > 1000, the condition is not met and no alert is generated.
The query result contains and matches: Checks both the number and content of rows in the set operation result. An alert is triggered only when a specific number of rows match the evaluate expression. For example, if the result set has four rows (pv=900, pv=1100, pv=1200, pv=1001) and the trigger condition is The query result contains and matches > 3, pv > 1000, the condition is met and an alert is generated.

Examples

Example 1

If the request success rate is less than 90% and the average response time of requests is longer than 60 seconds within a 15-minute period, an alert is triggered. Configuration details:

Query Statistics:

s0: Calculate the request success rate, which is indicated by success_ratio. Query statement: * | select round(sum(if(status < 300, 1, 0)) * 100.0 / count(1) , 2) as success_ratio.
s1: Calculate the average response time of requests per minute. Query statement: * | select date_format(date_trunc('minute',__time__), '%m-%d %H:%i') as t,avg(request_time) as "Average response time(s)" group by t order by t asc limit 2000

Trigger Condition: The evaluate expression is configured as: $0.success_ratio < 90 && $1.[Average response time(s)] > 60

Example 2

If the number of times that the HTTP status code 500 is returned exceeds 10 within a 15-minute period, an alert is triggered. Configuration details:

Query Statistics: Count the occurrences of each status code. Query statement: * | select status, COUNT(*) as total group by status

Trigger Condition: The evaluate expression is configured as: status == 500 && total > 10