Monitoring, logs, and alerts

Updated at:

Bailian CLI command reference for model call monitoring, call logs, and alert rules.

bl monitor, bl log, and bl alert query model call monitoring, call logs, traces, and alert rules, and manage monitoring delivery, log delivery, and alert templates.

NoteThese commands require console login (bl auth login --console) and use the observability services of the current workspace. Monitoring and log delivery must be activated separately before first use.

ImportantAppend --help to any command for full parameter details, e.g. bl monitor overview --help. Command details on this page are verified against bl 2.8.0.

Common flags

The following flags are available to all bl monitor, bl log, and bl alert commands and are not repeated in the command sections.

ParameterTypeDescription
--console-region <region>stringConsole gateway region, e.g. cn-beijing, ap-southeast-1
--console-site <site>stringConsole site: domestic, international
--console-switch-agent <uid>numberSwitch agent UID for delegated access
--workspace-id <id>stringWorkspace ID; can also be set with BAILIAN_WORKSPACE_ID
--output <format>stringOutput format: text, json
  • Business results default to JSON even when the Profile specifies text. Pass --output text or set DASHSCOPE_OUTPUT=text for text output.
  • Telemetry commands resolve the console identity of the selected workspace automatically, and use the same identity for preflight, business requests, asynchronous polling, and follow-up requests.
  • bl monitor and bl alert history query the last 7 days by default; bl log queries the last hour.
  • --start-time and --end-time override the default time range and accept ISO dates or millisecond timestamps.
  • Commands with pagination use --max-results and --skip; when a pagination token is returned, pass next-token back unchanged.
  • log audit count and log inference count use the totalCount from the corresponding list API without paginating or fetching full log content. Inference counts preserve multiple-model and multiple-API-key filters, deduplicate and query single-value combinations, and emit totals only after every query succeeds.

Monitoring

bl monitor overview

Show aggregated model call statistics, including call volume, success rate, failures, 4xx/5xx, average latency, first-token latency, and stream calls.

Usage

bl monitor overview [--days <days>] [--start-time <time>] [--end-time <time>] [--model <model>] [--api-key-id <id>] [--channel <channel>] [--source <source>]
ParameterTypeRequiredDescription
--days <days>numbernoDays to look back (default: 7)
--start-time <time>stringnoRange start; overrides --days
--end-time <time>stringnoRange end; default: now
--model <model>stringnoModel name(s), comma-separated
--api-key-id <id>stringnoAPI key ID(s), comma-separated
--channel <channel>stringnoCall channel(s), comma-separated
--source <source>stringnoCall source(s), comma-separated

Example: Show the last 7 days of call statistics

bl monitor overview --days 7

bl monitor models

List per-model or per-API-key call statistics with server-side sorting and pagination.

Usage

bl monitor models [--days <days>] [--start-time <time>] [--end-time <time>] [--model <model>] [--api-key-id <id>] [--channel <channel>] [--source <source>] [--sort-by <field>] [--order <ASC|DESC>] [--max-results <n>] [--skip <n>] [--next-token <token>]
ParameterTypeRequiredDescription
--days <days>numbernoDays to look back (default: 7)
--start-time <time>stringnoRange start; overrides --days
--end-time <time>stringnoRange end
--model <model>stringnoModel name(s), comma-separated
--api-key-id <id>stringnoAPI key ID(s), comma-separated
--channel <channel>stringnoCall channel(s), comma-separated
--source <source>stringnoCall source(s), comma-separated
--sort-by <field>stringnoSort field: modelAndWorkspaceId, callCount, callSuccessCount, callFailedCount, callFailedPercent, avgCallDuration, avgFirstTokenDuration (default: callCount)
--order <ASC|DESC>stringnoSort order (default: DESC)
--max-results <n>numbernoRows per page, 1-50 (default: 10)
--skip <n>numbernoRows to skip (default: 0)
--next-token <token>stringnoPagination token from a previous response

Example: Show the top 3 models by failure count

bl monitor models --days 7 --sort-by callFailedCount --order DESC --max-results 3

bl monitor metrics

Query time-series metrics such as call count, failures, latency percentiles, and token usage.

Usage

bl monitor metrics --metric <name>[,<name>...] [--agg <agg>] [--step <seconds>] [--days <days>] [--start-time <time>] [--end-time <time>] [--model <model>] [--api-key-id <id>] [--channel <channel>] [--source <source>]
ParameterTypeRequiredDescription
--metric <name>stringyesMetric name(s), comma-separated
--agg <agg>stringnoAggregation: sum, avg, max, min, p50, p95, p99, cumsum, cumavg, sum_pm (default: sum)
--step <seconds>numbernoData point interval: 60, 3600, or 86400 (default: auto by time range)
--days <days>numbernoDays to look back (default: 7)
--start-time <time>stringnoRange start; overrides --days
--end-time <time>stringnoRange end
--model <model>stringnoModel name(s), comma-separated
--api-key-id <id>stringnoAPI key ID(s), comma-separated
--channel <channel>stringnoCall channel(s), comma-separated
--source <source>stringnoCall source(s), comma-separated

View supported metrics

MetricDescription
model_call_countCall count
model_call_durationCall duration
model_first_token_durationFirst-token duration
model_generation_duration_per_tokenGeneration duration per token
model_call_failed_countFailed calls
model_call_4xx_count4xx calls
model_call_5xx_count5xx calls
model_call_429_count429 calls
model_call_data_inspection_failed_countContent inspection failures
model_total_amountTotal usage
model_input_amountInput usage
model_output_amountOutput usage
model_usageModel usage
model_tps_per_requestTPS per request
model_cache_hit_percentCache hit rate
model_ptu_token_quotaPTU token quota
model_ptu_usage_quotaPTU used quota
model_ptu_total_tokensPTU total tokens
model_ptu_quotaPTU quota
model_ptu_utilizationPTU utilization

Example: Query call count and failures for the last hour

bl monitor metrics --metric model_call_count,model_call_failed_count --days 1 --step 3600
  • Monitoring statistics count real-time (online) inference calls only.
  • When --start-time is set, it overrides --days.

bl monitor errors

Show the failure breakdown by HTTP status code and error code.

Usage

bl monitor errors [--days <days>] [--start-time <time>] [--end-time <time>] [--model <model>] [--api-key-id <id>] [--channel <channel>] [--source <source>]
ParameterTypeRequiredDescription
--days <days>numbernoDays to look back (default: 7)
--start-time <time>stringnoRange start; overrides --days
--end-time <time>stringnoRange end
--model <model>stringnoModel name(s), comma-separated
--api-key-id <id>stringnoAPI key ID(s), comma-separated
--channel <channel>stringnoCall channel(s), comma-separated
--source <source>stringnoCall source(s), comma-separated

Example: Show the last 7 days of failures

bl monitor errors --days 7
  • Each row includes httpStatusCode, errorCode, callCount, and callPercent.
  • errorCode is null when no server error code is available.

bl monitor delivery status

Show monitoring delivery status: CMS service-linked role, CMS service, Prometheus instance, and the delivery switch.

Usage

bl monitor delivery status

Example: Show monitoring delivery status

bl monitor delivery status
  • When not activated, returns Telemetry.SlrNotExist or cmsSlrAuthorized: false.
  • Text output includes the next action to take.

bl monitor delivery enable

Activate monitoring delivery: authorize the CMS service-linked role, activate the CMS service, create a dedicated Prometheus instance, and turn on monitoring delivery for all models.

Usage

bl monitor delivery enable [--no-wait]
ParameterTypeRequiredDescription
--no-waitswitchnoSubmit the activation requests and return without waiting for the instance to become ready

WarningThis activates the CMS service and a Prometheus instance, which may incur charges. Review the request with --dry-run before running it.

Example: Activate monitoring delivery

bl monitor delivery enable
  • Steps: authorize SLR → activate CMS service (async polling) → create Prometheus instance (async polling) → turn on the delivery switch.
  • The server throttles duplicate submissions within 30 seconds.

bl monitor delivery disable

Turn off monitoring delivery for all models.

Usage

bl monitor delivery disable

Example: Preview disabling monitoring delivery

bl monitor delivery disable --dry-run
  • Only the delivery switch is turned off; the CMS service and Prometheus instance (with stored data) are kept.
  • Run bl monitor delivery enable to resume delivery.

Logs

bl log status

Show log delivery status, including SLS authorization, audit and inference log services, and switches.

Usage

bl log status

Example: Show log delivery status

bl log status
  • Audit and inference logs have independent switches; inference logs require the audit log to stay on.
  • When not activated, returns Telemetry.SlrNotExist; run bl log audit enable first.

bl log audit list

Query model audit logs. Audit logs record call metadata, not request or response content.

Usage

bl log audit list [--hours <n>] [--start-time <time>] [--end-time <time>] [--model <model>] [--api-key-id <id>] [--channel <channel>] [--source <source>] [--call-source <Online|Offline>] [--request-id <id>] [--status-code <type>] [--max-results <n>] [--skip <n>] [--next-token <token>]
ParameterTypeRequiredDescription
--hours <hours>numbernoHours to look back (default: 1)
--start-time <time>stringnoRange start; overrides --hours
--end-time <time>stringnoRange end
--model <model>stringnoModel name(s), comma-separated
--api-key-id <id>stringnoAPI key ID(s), comma-separated
--channel <channel>stringnoCall channel(s), comma-separated
--source <source>stringnoCall source(s), comma-separated
--call-source <Online|Offline>stringnoInference type: Online, Offline
--request-id <id>stringnoExact model request ID
--status-code <type>stringnoStatus filter: SUCCESS, CLIENT_ERROR, SERVER_ERROR, CANCEL, comma-separated
--max-results <n>numbernoRows per page (default: 20)
--skip <n>numbernoRows to skip (default: 0)
--next-token <token>stringnoPagination token from a previous response

Example: Query audit logs for the last hour

bl log audit list --hours 1 --max-results 20
  • Audit logs include call time, model, status code, latency, token usage, and request ID.
  • Use inference logs for request and response content.

bl log audit get

Show a single audit log entry with its raw record.

Usage

bl log audit get --request-id <id> [--hours <n>] [--start-time <time>] [--end-time <time>] [--model <model>]
ParameterTypeRequiredDescription
--request-id <id>stringyesModel request ID (from log audit list)
--hours <hours>numbernoHours to look back (default: 1)
--start-time <time>stringnoRange start; overrides --hours
--end-time <time>stringnoRange end
--model <model>stringnoModel name to narrow the search

Example: Show the audit log for a specific request ID

bl log audit get --request-id 12345678-abcd-1234-abcd-123456789012 --hours 2

bl log audit count

Count audit logs in a time range, useful for estimating exports.

Usage

bl log audit count [--hours <n>] [--start-time <time>] [--end-time <time>] [--model <model>] [--api-key-id <id>]
ParameterTypeRequiredDescription
--hours <hours>numbernoHours to look back (default: 1)
--start-time <time>stringnoRange start; overrides --hours
--end-time <time>stringnoRange end
--model <model>stringnoModel name(s), comma-separated
--api-key-id <id>stringnoAPI key ID(s), comma-separated

Example: Count audit logs for the last 24 hours

bl log audit count --hours 24

bl log audit enable

Activate audit log delivery: authorize the SLS service-linked role, initialize the SLS instance, and turn on the audit log switch for all models.

Usage

bl log audit enable [--no-wait]
ParameterTypeRequiredDescription
--no-waitswitchnoReturn right after submitting, without waiting for the SLS instance

WarningThis initializes an SLS instance and incurs log storage charges. Review the request with --dry-run before running it.

Example: Activate audit log delivery

bl log audit enable
  • Audit log delivery is required before enabling inference log delivery.
  • Audit logs record call metadata only.

bl log audit disable

Disable audit log delivery for all models.

Usage

bl log audit disable

Example: Preview disabling audit log delivery

bl log audit disable --dry-run
  • Rejected while the inference log is still enabled; run bl log inference disable first.

bl log inference list

Query model inference logs, including request and response content.

Usage

bl log inference list [--hours <n>] [--start-time <time>] [--end-time <time>] [--model <model>] [--api-key-id <id>] [--request-id <id>] [--status-code <type>] [--call-source <Online|Offline>] [--max-results <n>] [--skip <n>]
ParameterTypeRequiredDescription
--hours <hours>numbernoHours to look back (default: 1)
--start-time <time>stringnoRange start; overrides --hours
--end-time <time>stringnoRange end
--model <model>stringnoModel name; the inference log API accepts a single model
--api-key-id <id>stringnoAPI key ID; the inference log API accepts a single ID
--request-id <id>stringnoExact model request ID
--status-code <type>stringnoStatus filter: SUCCESS, CLIENT_ERROR, SERVER_ERROR, CANCEL, comma-separated
--call-source <Online|Offline>stringnoInference type: Online, Offline
--max-results <n>numbernoRows per page (default: 20)
--skip <n>numbernoRows to skip (default: 0)

Example: Query inference logs for the last hour

bl log inference list --hours 1 --max-results 20
  • Inference log delivery must be enabled first.
  • The list contains summaries; use log inference get for full request and response content.

bl log inference get

Show the full request and response content of a single inference log entry.

Usage

bl log inference get --request-id <id> [--hours <n>] [--start-time <time>] [--end-time <time>] [--model <model>]
ParameterTypeRequiredDescription
--request-id <id>stringyesModel request ID (from log inference list)
--hours <hours>numbernoHours to look back (default: 1)
--start-time <time>stringnoRange start; overrides --hours
--end-time <time>stringnoRange end
--model <model>stringnoModel name to narrow the search

Example: Show the full inference log for a request

bl log inference get --request-id 12345678-abcd-1234-abcd-123456789012 --hours 2

bl log inference count

Count inference logs in a time range.

Usage

bl log inference count [--hours <n>] [--start-time <time>] [--end-time <time>] [--model <model>] [--api-key-id <id>]
ParameterTypeRequiredDescription
--hours <hours>numbernoHours to look back (default: 1)
--start-time <time>stringnoRange start; overrides --hours
--end-time <time>stringnoRange end
--model <model>stringnoModel name(s), comma-separated
--api-key-id <id>stringnoAPI key ID(s), comma-separated

Example: Count inference logs for the last 24 hours

bl log inference count --hours 24
  • Only calls made while inference log delivery was enabled are counted.

bl log inference enable

Activate inference log delivery: authorize the SLS service-linked role, initialize the SLS instance, and turn on the inference log switch for all models.

Usage

bl log inference enable [--no-wait]
ParameterTypeRequiredDescription
--no-waitswitchnoReturn right after submitting, without waiting for the SLS instance

WarningThis initializes an SLS instance and records request and response content, which may incur storage charges. Review the request with --dry-run before running it.

Example: Activate inference log delivery

bl log inference enable
  • Audit log delivery must be enabled first (bl log audit enable).

bl log inference disable

Disable inference log delivery for all models.

Usage

bl log inference disable

Example: Preview disabling inference log delivery

bl log inference disable --dry-run
  • Only the inference log is disabled; the audit log switch is unchanged.

bl log trace list

List call traces for a model or app.

Usage

bl log trace list --resource-id <id> [--resource-type <model|app>] [--hours <n>] [--start-time <time>] [--end-time <time>] [--max-results <n>] [--skip <n>]
ParameterTypeRequiredDescription
--resource-id <id>stringyesModel name or app ID to query
--resource-type <model|app>stringnoResource type: model, app (default: model)
--hours <hours>numbernoHours to look back (default: 1)
--start-time <time>stringnoRange start; overrides --hours
--end-time <time>stringnoRange end
--max-results <n>numbernoRows per page (default: 20)
--skip <n>numbernoRows to skip (default: 0)

Example: List traces for a specific model

bl log trace list --resource-id qwen3.6-plus --hours 1

bl log trace get

Show the span tree of a single call trace.

Usage

bl log trace get --trace-id <id> [--resource-id <id>] [--hours <n>] [--start-time <time>] [--end-time <time>]
ParameterTypeRequiredDescription
--trace-id <id>stringyesTrace ID (from log trace list)
--resource-id <id>stringnoModel name or app ID to narrow the search
--hours <hours>numbernoHours to look back (default: 1)
--start-time <time>stringnoRange start; overrides --hours
--end-time <time>stringnoRange end

Example: Show the span tree for a trace

bl log trace get --trace-id trace_xxx --resource-id qwen3.6-plus

bl log trace stats

Show per-resource trace statistics, including calls, token usage, and latency.

Usage

bl log trace stats [--resource-id <id>] [--resource-type <model|app>] [--hours <n>] [--start-time <time>] [--end-time <time>]
ParameterTypeRequiredDescription
--resource-id <id>stringnoModel name(s) or app ID(s), comma-separated; omit for all
--resource-type <model|app>stringnoResource type: model, app (default: model)
--hours <hours>numbernoHours to look back (default: 1)
--start-time <time>stringnoRange start; overrides --hours
--end-time <time>stringnoRange end

Example: Show app trace statistics for the last hour

bl log trace stats --resource-type app --hours 1
  • In testing, --resource-type model returned Not support resourceType model; use --resource-type app for app traces.

Alerts

bl alert metrics

List metrics that alert rules can use and their supported aggregations.

Usage

bl alert metrics

Example: List available alert metrics

bl alert metrics
  • Requires monitoring delivery to be activated (bl monitor delivery enable).
  • When not activated, returns The monitoring service is not activated yet.

bl alert template list

List official and custom alert templates; pass --template-id to view one template.

Usage

bl alert template list [--template-id <id>] [--name <name>] [--source <Official|Customize>] [--max-results <n>] [--skip <n>]
ParameterTypeRequiredDescription
--template-id <id>stringnoExact template ID
--name <name>stringnoFuzzy filter by template name
--source <Official|Customize>stringnoTemplate source: Official, Customize; omit for all
--max-results <n>numbernoRows per page (default: 50)
--skip <n>numbernoRows to skip (default: 0)

Example: List official alert templates

bl alert template list --source Official

bl alert template create

Create a custom alert template, or copy an existing template with --from.

Usage

bl alert template create --name <name> [--condition <metric:agg:cmp:value:period>...] [--from <template-id>] [--logical-operator <or|and>]
ParameterTypeRequiredDescription
--name <name>stringyesTemplate name (max 64 characters)
--condition <metric:agg:cmp:value:period>arraynoAlert condition, repeatable 1-10 times
--from <template-id>stringnoCopy conditions from an existing template
--logical-operator <or|and>stringnoHow multiple conditions combine (default: or)

Example: Create a failure-count alert template

bl alert template create --name failure-count --condition 'model_call_failed_count:sum:>:10:60'
  • The condition format is metric:aggregation:comparison:threshold:period, e.g. model_call_failed_count:sum:>:10:60.
  • When a condition contains > or <, quote the entire condition so the shell does not treat it as redirection.
  • Use bl alert metrics to list metric names.

bl alert template update

Update a custom alert template, replacing the complete condition list.

Usage

bl alert template update --template-id <id> --name <name> --condition <metric:agg:cmp:value:period>... [--logical-operator <or|and>]
ParameterTypeRequiredDescription
--template-id <id>stringyesTemplate ID
--name <name>stringyesTemplate name (max 64 characters)
--condition <metric:agg:cmp:value:period>arrayyesAlert condition, repeatable 1-10 times
--logical-operator <or|and>stringnoHow multiple conditions combine (default: or)

Example: Raise the failure threshold

bl alert template update --template-id 123 --name failure-count --condition 'model_call_failed_count:sum:>:20:60'

bl alert template delete

Delete custom alert templates. Official templates cannot be deleted.

Usage

bl alert template delete --template-id <id>[,<id>...]
ParameterTypeRequiredDescription
--template-id <id>stringyesTemplate ID(s), comma-separated
--yesswitchnoConfirm this high-risk operation

WarningThis permanently deletes the alert templates and cannot be undone.

Example: Preview deleting an alert template

bl alert template delete --template-id 123 --dry-run

bl alert list

List model alert rules.

Usage

bl alert list [--rule-id <id>] [--name <name>] [--enabled <true|false>] [--level <INFO|WARNING|ERROR>] [--max-results <n>] [--skip <n>] [--next-token <token>]
ParameterTypeRequiredDescription
--rule-id <id>stringnoExact rule ID
--name <name>stringnoFuzzy filter by rule name
--enabled <true|false>stringnoFilter by enabled state
--level <INFO|WARNING|ERROR>stringnoFilter by alert level
--max-results <n>numbernoRows per page (default: 20)
--skip <n>numbernoRows to skip (default: 0)
--next-token <token>stringnoPagination token from a previous response

Example: List enabled alert rules

bl alert list --enabled true

bl alert create

Create a model alert rule from an alert template.

Usage

bl alert create --name <name> --template-id <id> --model <model> [--message <text>] [--level <INFO|WARNING|ERROR>] [--interval <seconds>] [--duration <seconds>] [--contact <id>] [--contact-group <id>] [--notify-window <HH:mm-HH:mm>] [--notify-days <days>] [--silence <seconds>] [--gmt-offset <offset>]
ParameterTypeRequiredDescription
--name <name>stringyesAlert rule name (max 64 characters)
--template-id <id>stringyesAlert template ID (from alert template list)
--model <model>stringyesModel name(s) to alert on, comma-separated
--message <text>stringnoAlert notification content (Go template); defaults to the console template
--level <INFO|WARNING|ERROR>stringnoAlert level (default: INFO)
--interval <seconds>numbernoCheck interval (default: 60)
--duration <seconds>numbernoHow long the condition must hold; 0 = immediately (default: 60)
--contact <id>stringnoCloudMonitor contact ID(s), comma-separated
--contact-group <id>stringnoCloudMonitor contact group ID(s), comma-separated
--notify-window <HH:mm-HH:mm>stringnoDaily notification window (default: 00:00-23:59)
--notify-days <days>stringnoDays of week, 1-7, comma-separated (default: every day)
--silence <seconds>numbernoSilence period between repeat notifications (default: never repeat)
--gmt-offset <offset>stringnoTimezone offset for the notify window (default: +0800)

Example: Create a failure-count alert for a model

bl alert create --name high-failure-rate --template-id 123 --model qwen3.6-plus
  • Alert conditions come from the template; choose one with alert template list.
  • Create contacts and contact groups in the CloudMonitor console, then pass their IDs.
  • Use --dry-run to inspect the request body before creating.

bl alert update

Update a model alert rule, replacing all fields.

Usage

bl alert update --rule-id <id> --name <name> --template-id <id> --model <model> [--message <text>] [--level <INFO|WARNING|ERROR>] [--interval <seconds>] [--duration <seconds>] [--contact <id>] [--contact-group <id>] [--notify-window <HH:mm-HH:mm>] [--notify-days <days>] [--silence <seconds>] [--gmt-offset <offset>]
ParameterTypeRequiredDescription
--rule-id <id>stringyesAlert rule ID (from alert list)
--name <name>stringyesAlert rule name
--template-id <id>stringyesAlert template ID
--model <model>stringyesModel name(s) to alert on, comma-separated
--message <text>stringnoAlert notification content (Go template)
--level <INFO|WARNING|ERROR>stringnoAlert level (default: INFO)
--interval <seconds>numbernoCheck interval (default: 60)
--duration <seconds>numbernoHow long the condition must hold (default: 60)
--contact <id>stringnoContact ID(s), comma-separated
--contact-group <id>stringnoContact group ID(s), comma-separated
--notify-window <HH:mm-HH:mm>stringnoDaily notification window
--notify-days <days>stringnoDays of week, 1-7
--silence <seconds>numbernoSilence period between repeat notifications
--gmt-offset <offset>stringnoTimezone offset for the notify window

Example: Change the alert level

bl alert update --rule-id 789 --name high-failure-rate --template-id 123 --model qwen3.6-plus --level WARNING

bl alert delete

Delete model alert rules.

Usage

bl alert delete --rule-id <id>[,<id>...]
ParameterTypeRequiredDescription
--rule-id <id>stringyesRule ID(s), comma-separated
--yesswitchnoConfirm this high-risk operation

WarningThis permanently deletes the alert rules and cannot be undone.

Example: Preview deleting an alert rule

bl alert delete --rule-id 789 --dry-run

bl alert enable

Enable a model alert rule.

Usage

bl alert enable --rule-id <id>
ParameterTypeRequiredDescription
--rule-id <id>stringyesAlert rule ID

Example: Enable an alert rule

bl alert enable --rule-id 789

bl alert disable

Disable a model alert rule. The rule is kept but notifications stop.

Usage

bl alert disable --rule-id <id>
ParameterTypeRequiredDescription
--rule-id <id>stringyesAlert rule ID

Example: Disable an alert rule

bl alert disable --rule-id 789

bl alert history

List model alert history, including firing and recovered events.

Usage

bl alert history [--days <days>] [--start-time <time>] [--end-time <time>] [--rule-id <id>] [--status <ALARM|OK>] [--level <INFO|WARNING|ERROR>] [--max-results <n>] [--skip <n>] [--next-token <token>]
ParameterTypeRequiredDescription
--days <days>numbernoDays to look back (default: 7)
--start-time <time>stringnoRange start; overrides --days
--end-time <time>stringnoRange end
--rule-id <id>stringnoFilter by alert rule ID
--status <ALARM|OK>stringnoAlert state: ALARM (firing), OK (recovered)
--level <INFO|WARNING|ERROR>stringnoFilter by highest alert level
--max-results <n>numbernoRows per page, 1-50 (default: 10)
--skip <n>numbernoRows to skip (default: 0)
--next-token <token>stringnoPagination token from a previous response

Example: Show alerts that fired in the last 7 days

bl alert history --days 7 --status ALARM