ALIYUN::SLS::Alert-Resource Orchestration Service(ROS)-阿里云帮助中心

The ALIYUN::SLS::Alert resource is used to create an alert.

Syntax

{
  "Type": "ALIYUN::SLS::Alert",
  "Properties": {
    "Project": String,
    "Detail": Map
  }
}

Properties

Property name	Type	Required	Update allowed	Description	Constraints
Project	String	Yes	No	The name of the Simple Log Service project.	None
Detail	Map	Yes	Yes	The details of the alert.	For more information, see Detail properties.

Detail syntax

"Detail": {
  "Type": String,
  "Description": String,
  "Configuration": Map,
  "State": String,
  "Schedule": Map,
  "DisplayName": String,
  "Name": String
}

Detail properties

Property name	Type	Required	Update allowed	Description	Constraints
Type	String	No	No	The type of the alert.	None
Description	String	No	Yes	The description of the alert.	None
Configuration	Map	Yes	Yes	The alert configuration.	For more information, see Configuration properties.
State	String	No	No	Specifies whether to enable the alert.	Valid values: Enable: enables the alert. Disabled: disables the alert.
Schedule	Map	Yes	Yes	The interval at which Simple Log Service evaluates the alert rule.	During the evaluation of an alert rule, if a query returns more than 100 log entries, only the first 100 log entries are checked. For more information, see Schedule properties.
DisplayName	String	Yes	Yes	The display name of the alert.	The value must be 1 to 64 characters in length.
Name	String	Yes	No	The name of the alert.	None

Configuration syntax

"Configuration": {
  "Throttling": String,
  "Condition": String,
  "NotificationList": List,
  "NotifyThreshold": Integer,
  "Dashboard": String,
  "QueryList": List,
  "Type": String,
  "GroupConfiguration": Map,
  "NoDataFire": Boolean,
  "Threshold": Integer,
  "SeverityConfigurations": List,
  "Labels": List,
  "AutoAnnotation": Boolean,
  "PolicyConfiguration": Map,
  "SendResolved": Boolean,
  "NoDataSeverity": Integer,
  "Annotations": List,
  "MuteUntil": Integer,
  "JoinConfigurations": List,
  "Version": String
}

Configuration properties

Property name	Type	Required	Update allowed	Description	Constraints
Throttling	String	No	Yes	The notification interval.	None
Condition	String	No	Yes	The trigger condition.	It supports five basic operators: addition (+), subtraction (-), multiplication (*), division (/), and modulo operation (%). It also supports eight comparison operators: greater than (>), greater than or equal to (>=), less than (<), less than or equal to (<=), equal to (==), not equal to (!=), regular expression match (=~), and regular expression mismatch (!~). For more information, see Alert condition expression syntax.
NotificationList	List	No	Yes	The notification list.	For more information, see NotificationList properties.
NotifyThreshold	Integer	No	Yes	The threshold for triggering notifications.	None
Dashboard	String	Yes	Yes	The dashboard to which the alert belongs.	None
QueryList	List	Yes	Yes	The query list.	For more information, see QueryList properties.
Type	String	No	Yes	The type of the alert.	The value is fixed to default.
GroupConfiguration	Map	No	Yes	The configuration for evaluation by group.	For more information, see GroupConfiguration properties.
NoDataFire	Boolean	No	Yes	Specifies whether to trigger an alert when no data is found.	Valid values: true: enables no-data alerts. If the number of times that the query and analysis returns no data exceeds the consecutive trigger threshold, an alert is generated. Note If the query and analysis returns multiple results, the result of the set operation is used. For more information, see No-data alerts. false (default): disables no-data alerts.
Threshold	Integer	No	Yes	You can set the consecutive trigger threshold.	An alert is generated when the cumulative number of triggers reaches this value. If the trigger condition is not met, the trigger is not counted.
SeverityConfigurations	List	No	Yes	The trigger conditions. Set at least one trigger condition.	For more information, see SeverityConfigurations properties.
Labels	List	No	Yes	The labels.	For more information, see Labels properties.
AutoAnnotation	Boolean	No	Yes	Specifies whether to automatically add annotations.	Valid values: true (default): enables automatic annotations. The system automatically adds information such as __count__ to the alert. For more information, see Automatic annotations. false: disables automatic annotations.
PolicyConfiguration	Map	No	Yes	The alert policy configuration.	For more information, see PolicyConfiguration properties.
SendResolved	Boolean	No	Yes	Specifies whether to send recovery notifications.	Valid values: true: enables recovery notifications. When an alert recovers, a recovery alert is sent. For more information, see Set recovery notifications. false (default): disables recovery notifications.
NoDataSeverity	Integer	No	Yes	The alert severity when a no-data alert is triggered.	For more information, see Alert severity.
Annotations	List	No	Yes	The annotations.	For more information, see Annotations properties.
MuteUntil	Integer	No	Yes	The threshold that triggers an alert.	None
JoinConfigurations	List	No	Yes	The configuration for join operations.	For more information, see JoinConfigurations properties. If QueryList contains only one query, you do not need to set JoinConfigurations. If QueryList contains two or three queries, you must set JoinConfigurations to associate the results of multiple query analyses. For more information, see Set query statements.
Version	String	No	Yes	The alert version.	The value is fixed to 2.0.

NotificationList syntax

"NotificationList": [
  {
    "Type": String,
    "MobileList": List,
    "ServiceUri": String,
    "Content": String,
    "EmailList": List,
    "Method": String,
    "Headers": Map
  }
]

NotificationList properties

Property name	Type	Required	Update allowed	Description	Constraints
Type	String	Yes	No	The notification type.	Valid values: SMS: text message. Voice: voice call. Email: email. MessageCenter: The system's notification center. DingTalk: WebHook-DingTalk Robot. Webhook: WebHook-Custom.
Content	String	No	No	The notification content.	Template variables are supported: `${Project}, ${Condition}, ${AlertName}, ${AlertID}, ${Dashboard}, ${FireTime}, ${Results}`. For more information, see Notification methods.
MobileList	List	No	No	The mobile phone numbers.	This parameter is required when Type is set to SMS or Voice. A mobile phone number can receive a maximum of 50 notifications per day.
ServiceUri	String	No	No	The request URL.	This parameter is required when Type is set to Webhook or DingTalk.
EmailList	List	No	No	The email addresses.	This parameter is required when Type is set to Email. An email address can receive a maximum of 100 emails per day.
Method	String	No	No	The request method.	None
Headers	Map	No	No	The request headers.	None

QueryList syntax

"QueryList": [
  {
    "Query": String,
    "LogStore": String,
    "Start": String,
    "TimeSpanType": String,
    "End": String,
    "ChartTitle": String,
    "DashboardId": String,
    "Region": String,
    "RoleArn": String,
    "StoreType": String,
    "PowerSqlMode": String,
    "Project": String,
    "Store": String
  }
]

QueryList properties

Property name	Type	Required	Update allowed	Description	Constraints
Query	String	Yes	No	The search statement.	None
LogStore	String	No	No	The Logstore.	None
Start	String	Yes	No	The start time of the query.	None
TimeSpanType	String	Yes	No	The query time range.	None
End	String	Yes	No	The end time of the query.	None
ChartTitle	String	No	No	The chart title.	None
DashboardId	String	No	No	The ID of the alert dashboard.	None
Region	String	No	No	The region where the queried project resides.	None
RoleArn	String	No	No	The Alibaba Cloud Resource Name (ARN) of the RAM role required to access the data.	For more information, see Grant permissions to monitor data across projects.
StoreType	String	No	No	The type of the data source.	Valid values: log: Logstore. Metric: Metricstore. meta: resource data.
PowerSqlMode	String	No	No	Specifies whether to use dedicated SQL.	Valid values: auto: automatic switchover. enable: enables dedicated SQL. disable: disables dedicated SQL.
Project	String	No	No	The associated project.	None
Store	String	No	No	The associated Logstore, Metricstore, or resource data.	None

Schedule syntax

"Schedule": {
  "Type": String,
  "Interval": String,
  "Hour": Integer,
  "DayOfWeek": Integer,
  "CronExpression": String,
  "Delay": Integer,
  "RunImmediately": Boolean
}

Schedule properties

Property name	Type	Required	Update allowed	Description	Constraints
Type	String	Yes	Yes	The type.	Valid values: Hourly: every hour. Daily: every day. Weekly: every week. FixedRate: fixed interval. Cron: cron expression.
Interval	String	No	Yes	The trigger interval.	This parameter is required when Type is set to FixedRate. Examples: 10d: 10 days. 10h: 10 hours. 10m: 10 minutes.
Hour	Integer	No	Yes	The trigger time.	This parameter is required when Type is set to Daily or Weekly. The value ranges from 0 to 23.
DayOfWeek	Integer	No	Yes	The day of the week to trigger the alert.	This parameter is required when Type is set to Weekly. The value ranges from 1 to 7.
CronExpression	String	No	Yes	The cron expression.	This parameter is required when Type is set to Cron.
RunImmediately	Boolean	No	Yes	Specifies whether to trigger the alert immediately.	Valid values: true: triggers the alert immediately. false: does not trigger the alert immediately.
Delay	Integer	No	Yes	Deferred execution	None

SeverityConfigurations syntax

"SeverityConfigurations": {
 "EvalCondition": Map,
 "Severity": Integer
}

SeverityConfigurations properties

Property name	Type	Required	Update allowed	Description	Constraints
EvalCondition	Map	No	No	The trigger condition.	For more information, see EvalCondition properties.
Severity	Integer	Yes	No	The alert severity.	For more information, see Alert severity. Valid values: Critical (10), High (8), Medium (6), Low (4), and Report (2).

EvalCondition syntax

"EvalCondition": {
"Condition": String,
"CountCondition": String
}

EvalCondition properties

Property name	Type	Required	Update allowed	Description	Constraints
Condition	String	No	No	The data matching expression.	If you do not need to evaluate the data content, set this to an empty string. Otherwise, set this to an expression, such as errCnt > 10.
CountCondition	String	No	No	The expression for evaluating the number of data entries.	If the condition is met as long as data exists, set this to an empty string. Otherwise, set this to an expression, such as __count__ > 3.

Labels syntax

"Labels": [{
 "Value": String,
 "Key": String
}]

Labels properties

Property name	Type	Required	Update allowed	Description	Constraints
Value	String	Yes	No	The field value.	None
Key	String	Yes	No	The field name.	None

GroupConfiguration syntax

"GroupConfiguration": {
 "Type": String,
 "Fields": List
}

GroupConfiguration properties

Property name	Type	Required	Update allowed	Description	Constraints
Type	String	Yes	No	The type of evaluation by group.	Valid values: no_group: no group. custom: custom. labels_auto: automatic labels. This value applies only to time series data.
Fields	List	No	No	The fields used for evaluation by group.	None

Annotations syntax

"Annotations": [{
 "Value": String,
 "Key": String
}]

Annotations properties

Property name	Type	Required	Update allowed	Description	Constraints
Key	String	Yes	No	The field name.	None
Value	String	Yes	No	The field value.	None

JoinConfigurations syntax

"JoinConfigurations": {
 "Type": String,
 "Condition": String
}

JoinConfigurations properties

Property name	Type	Required	Update allowed	Description	Constraints
Condition	String	No	No	The conditional expression.	This parameter is required when Type is set to cross_join, concat, or no_join. Example: $0.host == $1.ip.
Type	String	Yes	No	The type of the join operation.	Valid values: cross_join: Cartesian product. inner_join: inner join. left_join: left join. right_join: right join. full_join: full join. left_exclude: left exclude. right_exclude: right exclude. concat: concatenates and traverses each dataset in order. no_join: does not merge and uses only the first dataset.

PolicyConfiguration syntax

"PolicyConfiguration": {
"RepeatInterval": String,
 "ActionPolicyId": String,
 "AlertPolicyId": String,
 "UseDefault": Boolean
}

PolicyConfiguration properties

Property name	Type	Required	Update allowed	Description	Constraints
RepeatInterval	String	No	No	The repeat interval.	None
ActionPolicyId	String	No	No	The ID of the action policy.	If you use the advanced mode and the selected alert policy is not configured with a dynamic action policy, set ActionPolicyId to an empty string.
AlertPolicyId	String	No	No	The ID of the alert policy.	If you use the simple mode or standard mode, set this to sls.builtin.dynamic (the system's built-in dynamic alert policy). If you use the advanced mode, set this to a specified alert policy ID.
UseDefault	Boolean	No	No	A compatible field.	The value is fixed to false.

Return value

Fn::GetAtt

Name: The name of the alert.

Examples

YAML format

ROSTemplateFormatVersion: '2015-09-01'
Parameters: {}
Resources:
  Alert:
    Type: ALIYUN::SLS::Alert
    Properties:
      Project: TestSlsProject
      Detail:
        DisplayName: ros-test-alert
        Description: test
        Schedule:
          Delay: 1
          Interval: 15m
          Type: FixedRate
          RunImmediately: false
        State: Enabled
        Configuration:
          Throttling: 5m
          NotifyThreshold: 1
          QueryList:
            - End: now
              LogStore: audit-cf5362d1f87754fb29
              ChartTitle: k8s-log-c7b729e7ea122425182133bc2c3ea
              Start: '-15m'
              Query: |-
                objectRef.resource : "networkpolicies" and verb : create NOT  user.username: node NOT  user.username: serviceaccount NOT  user.username: apiserver NOT  user.username: kube-scheduler NOT  user.username: kube-controller-manager       | SELECT auditID as "Event ID", date_format(from_unixtime(__time__), '%Y-%m-%d %T' ) as "Operation Time", "objectRef.name" as "Name", "objectRef.namespace" as "Namespace", "responseStatus.code" as "Status Code",
                 CASE WHEN "user.username" != 'kubernetes-admin' then "user.username"
                 WHEN "user.username" = 'kubernetes-admin' and regexp_like("annotations.authorization.k8s.io/reason", 'RoleBinding') then regexp_extract("annotations.authorization.k8s.io/reason", ' to User "(\w+)"', 1) ELSE 'kubernetes-admin' END
                 as "Operator Account",
                CASE WHEN json_array_length(sourceIPs) = 1 then json_format(json_array_get(sourceIPs, 0)) ELSE  sourceIPs END
                as "Source Address" order by "Operation Time"
              TimeSpanType: Custom
          Dashboard: audit-cf5362d1f87754fb4a_network_policy_op_cn
          NotificationList:
            - Content: Message
              ServiceUri: http://xxxx
              Type: DingTalk
            - Content: Email Message
              EmailList:
                - abc@test.com
              Type: Email
            - MobileList:
                - 132373830xx
              Content: Cellphone message
              Type: SMS
          Condition: total  > 1
        Type: Alert
        Name: alert_2
Outputs:
  Name:
    Description: Alert name.
    Value:
      Fn::GetAtt:
        - Alert
        - Name

JSON format

{
  "ROSTemplateFormatVersion": "2015-09-01",
  "Parameters": {
  },
  "Resources": {
    "Alert": {
      "Type": "ALIYUN::SLS::Alert",
      "Properties": {
        "Project": "TestSlsProject",
        "Detail": {
          "DisplayName": "ros-test-alert",
          "Description": "test",
          "Schedule": {
            "Delay": 1,
            "Interval": "15m",
            "Type": "FixedRate",
            "RunImmediately": false
          },
          "State": "Enabled",
          "Configuration": {
            "Throttling": "5m",
            "NotifyThreshold": 1,
            "QueryList": [
              {
                "End": "now",
                "LogStore": "audit-cf5362d1f87754fb29",
                "ChartTitle": "k8s-log-c7b729e7ea122425182133bc2c3ea",
                "Start": "-15m",
                "Query": "objectRef.resource : \"networkpolicies\" and verb : create NOT  user.username: node NOT  user.username: serviceaccount NOT  user.username: apiserver NOT  user.username: kube-scheduler NOT  user.username: kube-controller-manager       | SELECT auditID as \"Event ID\", date_format(from_unixtime(__time__), '%Y-%m-%d %T' ) as \"Operation Time\", \"objectRef.name\" as \"Name\", \"objectRef.namespace\" as \"Namespace\", \"responseStatus.code\" as \"Status Code\",\n CASE WHEN \"user.username\" != 'kubernetes-admin' then \"user.username\"\n WHEN \"user.username\" = 'kubernetes-admin' and regexp_like(\"annotations.authorization.k8s.io/reason\", 'RoleBinding') then regexp_extract(\"annotations.authorization.k8s.io/reason\", ' to User \"(\\w+)\"', 1) ELSE 'kubernetes-admin' END  \n as \"Operator Account\", \nCASE WHEN json_array_length(sourceIPs) = 1 then json_format(json_array_get(sourceIPs, 0)) ELSE  sourceIPs END\nas \"Source Address\" order by \"Operation Time\"",
                "TimeSpanType": "Custom"
              }
            ],
            "Dashboard": "audit-cf5362d1f87754fb4a_network_policy_op_cn",
            "NotificationList": [
              {
                "Content": "Message",
                "ServiceUri": "http://xxxx",
                "Type": "DingTalk"
              },
              {
                "Content": "Email Message",
                "EmailList": [
                  "abc@test.com"
                ],
                "Type": "Email"
              },
              {
                "MobileList": [
                  "132373830xx"
                ],
                "Content": "Cellphone message",
                "Type": "SMS"
              }
            ],
            "Condition": "total  > 1"
          },
          "Type": "Alert",
          "Name": "alert_2"
        }
      }
    }
  },
  "Outputs": {
    "Name": {
      "Description": "Alert name.",
      "Value": {
        "Fn::GetAtt": [
          "Alert",
          "Name"
        ]
      }
    }
  }
}