Log monitors alert when a specified type of log exceeds a user-defined threshold over a given period of time. Common use cases for this monitor include:
Define the search query: the log explorer search
The search query has the same behavior as(Optional) Define the alert grouping:
With or without alert grouping defined, you get one alert when the aggregated value meets the conditions set below. Even if you split the query by host, a single notification is sent if several hosts meet the conditions set below. This is done to reduce notification noise.Set alert conditions. The following options can be used:
Then configure the Alert and/or Warning threshold depending on the chosen condition:
It is possible to add up to 10 samples of logs that triggered the monitor in the notification message. This is available for Slack, Jira, and email notifications.
Enabling log samples in notifications:
Example for a Slack notification
For Slack and email notifications you can enable the top 10 of breaching values in your multi alert notifications.
Enabling top 10 breaching values in notifications
Example for a Slack notification
To be notified if a specific set of logs are not received anymore, set the condition below 1
. This notifies when no logs match the monitor query on the given timeframe.
However, note that when splitting the monitor by any dimension (tag or facet) and using a below
condition, the alert is triggered if and only if there are logs for a given group, and the count is below the threshold—or if there are no logs for all of the groups.
Examples:
backend
:Additional helpful documentation, links, and articles: