Simple Log Service allows you to use an evaluate expression when you specify a trigger condition in an alert monitoring rule. For example, you set the Trigger Condition parameter to Data matches the expression and you specify an evaluate expression. If data in the query and analysis results matches the specified evaluate expression, an alert is triggered.
Overview
In an alert rule, you can specify the results of query statements as the input and the fields in the results of set operations as variables. If the evaluate expression returns true, an alert is triggered.
Configure a trigger condition
In a trigger condition, the evaluate expression is used to evaluate the results of set operations. If the evaluate expression returns true, an alert is triggered. The trigger conditions support the following options:
Data is returned: If the results of set operations contain data, an alert is triggered.
The query result contains: If the results of set operations contain a specific number of data entries, an alert is triggered. Supported comparison operators include greater than (>), less than (<), and equal to (==). For example, if you specify the query result contains > 10 as the trigger condition and the results of set operations contain four data entries, no alert is triggered because the number of data entries in the results does not meet the specified trigger condition.
Data matches the expression: If the results of set operations contain data that matches a specified evaluate expression, an alert is triggered. For example, if you specify data matches the expression, pv>1000 as the trigger condition and the results of set operations contain only one data entry whose page view (PV) is 900, no alert is triggered because the data in the results does not meet the specified trigger condition.
The query result contains and matches: If the results of set operations contain a specific number of data entries that match a specified evaluate expression, an alert is triggered. For example, if you specify the query result contains and matches>3, pv>1000 as the trigger condition and the results of set operations contain four data entries whose respective PVs are 900, 1100, 1200, and 1001, an alert is triggered because the data in the results meets the specified trigger condition.
