DocsICP FilingConsole
Documentation

Keyword match alerts

Updated at:
Copy as MD
Product
My Favorites

Keyword match alerts is a monitoring product that sends an alert when a keyword is found in a log. The alert can contain the full log entry or an extracted part of the log entry. This product provides only alerting features and does not support data statistics or data viewing.

Scenarios

For example, police are tracking a car with the license plate Yue A12345 and need an alert each time the car passes a toll station. Using keyword match alerts, they can monitor for the license plate number as a keyword.

Log content:

2012-11-1111:11:11YueA123**,Guangzhou North Toll Station,G25,Guangzhou,¥50
2012-11-1111:11:11YueA123**,Guangzhou North Toll Station,G26,Guangzhou,¥50
2012-11-1111:11:13YueA123**,Guangzhou North Toll Station,G27,Guangzhou,¥50
2012-11-1111:11:14YueA123**,Guangzhou North Toll Station,G27,Guangzhou,¥50
2012-11-1111:11:15YueA123**,Guangzhou North Toll Station,G26,Guangzhou,¥50
...

Procedure

  1. Log on to the Real-time Monitoring console. In the navigation pane on the left, choose Custom Monitoring > New > New Monitoring Product.

  2. On the Advanced tab, click Keyword Match Alert.

  3. Configure the basic information. In the Basic Information section, enter a Monitoring Configuration Name, select an Application, and specify the Log File to Collect. In this example, the Monitoring Configuration Name is set to 'Failed Alert'.

  4. Configure log filtering. You can configure a whitelist or a blacklist. For more information, see Configure log filtering.

  5. Configure alerts. By default, the alert content for a keyword match alert is the entire log entry. Configure the following parameters:

    • Alert Title: Enter a custom title.

    • Maximum Number of Log Entries in Alert: The maximum number of full log entries to include in an alert.

    • Minimum Matched Log Entries to Trigger Text Message Alert: The minimum number of matches within one minute required to trigger a text message alert. For example, if you set this parameter to 2, a text message alert is sent if two matches occur within one minute.

  6. Configure the alert content. If you do not want the entire log entry to be the alert content, you can use a regular expression to extract a specific part of the log entry.

    Important

    If you do not configure log filtering, you must configure custom alert content.