Configure alerts

更新时间:
复制 MD 格式

Simple Log Service lets you configure alerts on the Search & Analysis page or a dashboard. When the trigger condition of an alert rule is met, Simple Log Service sends a notification.

Prerequisites

  • Log data has been collected.

  • An index has been configured. For more information, see Create an index.

Background information

Simple Log Service allows you to configure alerts based on statistical charts. You can save a chart to a dashboard and save it as an alert. Alternatively, you can configure an alert for an existing chart on a dashboard.

Important

If a chart in a dashboard is associated with an alert rule, you must manually update the query statement in the alert rule after you update the query statement for the chart. For more information, see Modify an alert monitoring rule.

  • Create a chart and configure an alert

    When you configure an alert on the Search & Analysis page, you must specify the destination dashboard and a name for the chart. On the right side of the log search histogram, open the Alert Status panel, and click Old Version Alert at the bottom of the panel to begin.

  • Configure an alert for an existing chart on a dashboard

    You can configure an alert for one or more charts in a dashboard. If you configure an alert for multiple charts, you can define a combined trigger condition.仪表盘告警

Procedure

  1. Log on to the Simple Log Service console.

  2. In the Projects section, click the one you want.

    image

  3. In the dashboard list, click the target dashboard.

  4. On the dashboard page, choose Alert > Create Old Version Alert.

  5. In the Alert Configuration wizard, set the following parameters and click Next.

    Parameter

    Description

    Alert Name

    The name of the alert. The name must be 4 to 64 characters long.

    Association Chart

    The chart associated with the alert rule.

    You can add one to three charts to create an alert based on multiple Search & Analysis results. The number before each chart name is its ID within the alert. You can use this ID to reference the chart in the Trigger Condition.

    The Query Time Range specifies the time range for the data query and analysis. For example, if the current time is 14:30:06 and you set Query Time Range to 1 Hour (Relative), the service queries data from 13:30:06-14:30:06.

    Click the Edit icon 编辑 next to the query statement to modify it. For more information about how to write a query statement, see Analysis overview.

    Frequency

    How often Simple Log Service checks the query and analysis results.

    • Hourly: Check the query and analysis results every hour.

    • Daily: Check the query and analysis results at a specified time each day.

    • Weekly: Check the query and analysis results at a specified time on a specified day each week.

    • Fixed Interval: Check the query and analysis results at a specified interval.

    • Cron: Check the query and analysis results at intervals specified by a Cron expression.

      Cron expressions have a minimum precision of one minute and use a 24-hour clock. For example, 0 0/1 * * * specifies that checks start at 00:00 and run once every hour.

    Note

    Simple Log Service checks only the first 100 log entries of the query and analysis results.

    Trigger Condition

    An alert is triggered when the expression evaluates to true. For more information, see Alert condition expression syntax.

    Separate multiple conditions with two ampersands (&&). For example: pv%100 > 0 && uv > 0.

    Use $ID to distinguish between different associated charts. For example, in $0.pv>1000&&$1.pv>1000, $0 refers to the chart with ID 0 and $1 refers to the chart with ID 1. For more information, see How do I view chart IDs?.

    Notification Trigger Threshold

    The number of times the trigger condition must be met before a notification is sent. The count increments only when the trigger condition is met.

    The default value is 1, meaning the notification interval is checked after the trigger condition is met once.

    You can use this parameter to send a single notification for multiple alert triggers. For example, if Notification Trigger Threshold is set to 100, the system checks the notification interval only after the trigger condition has been met 100 times. If both the Notification Trigger Threshold and Notification Interval conditions are met, a notification is sent. After the notification is sent, the trigger count resets to zero. The system does not count checks that fail due to issues like network exceptions.

    Notification Interval

    The minimum time between alert notifications.

    If a check meets the trigger condition and the cumulative trigger count reaches the Notification Trigger Threshold, a notification is sent only if the specified Notification Interval has passed since the last notification. For example, if the notification interval is 5 minutes, you will receive at most one notification within any 5-minute period.

    Note

    Use the Notification Trigger Threshold and Notification Interval to suppress alerts and avoid excessive notifications.

  6. In the Notification wizard, configure the notification methods, and then click Submit.

    Notification methods include SMS messages, voice calls, email, DingTalk chatbot webhooks, custom webhooks, and Alibaba Cloud Message Center. You can add multiple notification methods. You can also click Import Notification Configurations. For more information about notification methods and how to configure them, see Notification methods.

FAQ

How do I view chart IDs?

The number for each chart and its corresponding query statement is displayed in Association Chart. The first chart and query statement is numbered 0, the second is 1, and the third is 2. On the alert configuration page, in the Associated Charts area, the corresponding number is displayed to the left of each chart. The numbering starts from 0 and increments based on the order in which the charts are added.

Next steps

After you create an alert rule, you can view its alert records. For more information, see View alert records.