Copy as Markdown[Open in ChatGPT](https://chatgpt.com/?q=Read%20https%3A%2F%2Fdocs-docusaurus.kinsta.page%2Fdeveloper-portal%2Fapis%2Fdata-management%2Falerts-api%2Falerts-grpc-api.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)[Open in Claude](https://claude.ai/new?q=Read%20https%3A%2F%2Fdocs-docusaurus.kinsta.page%2Fdeveloper-portal%2Fapis%2Fdata-management%2Falerts-api%2Falerts-grpc-api.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)[API reference](https://docs-docusaurus.kinsta.page/api-reference/v5/alert-definitions-service/.md)

# Alerts API v3

Use the **Alerts API v3** to define, query, and manage [Coralogix Alerts](https://docs-docusaurus.kinsta.page/user-guides/alerting/introduction-to-alerts/.md). View [this tutorial](https://docs-docusaurus.kinsta.page/developer-portal/apis/data-management/alerts-api/alerts-api-v1-v2/.md) for **v1/v2**.

## Overview[​](#overview "Direct link to Overview")

This tutorial outlines Coralogix's v3 Alerts gRPC API, designed for simplicity and ease of use. Using protobuf, it supports clients with autocomplete features, such as Kreya's gRPC.

## Authentication[​](#authentication "Direct link to Authentication")

### Authenticate requests[​](#authenticate-requests "Direct link to Authenticate requests")

To authenticate requests, create a [customized Team API key](https://docs-docusaurus.kinsta.page/user-guides/account-management/api-keys/api-keys/.md) with the **Alerts** role preset assigned to it. Alternatively, selectively add any of the following permissions to your key:

| **Method**      | **Permission**                                                                                                                                                      |
| --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| ListAlertDefs   | alerts<!-- -->:ReadConfig<!-- --> OR logs.alerts<!-- -->:ReadConfig<!-- --> OR metrics.alerts<!-- -->:ReadConfig<!-- --> OR spans.alerts<!-- -->:ReadConfig         |
| GetAlertDef     | alerts<!-- -->:ReadConfig<!-- --> OR logs.alerts<!-- -->:ReadConfig<!-- --> OR metrics.alerts<!-- -->:ReadConfig<!-- --> OR spans.alerts<!-- -->:ReadConfig         |
| CreateAlertDef  | alerts<!-- -->:UpdateConfig<!-- --> OR logs.alerts<!-- -->:UpdateConfig<!-- --> OR metrics.alerts<!-- -->:UpdateConfig<!-- --> OR spans.alerts<!-- -->:UpdateConfig |
| ReplaceAlertDef | alerts<!-- -->:UpdateConfig<!-- --> OR logs.alerts<!-- -->:UpdateConfig<!-- --> OR metrics.alerts<!-- -->:UpdateConfig<!-- --> OR spans.alerts<!-- -->:UpdateConfig |
| DeleteAlertDef  | alerts<!-- -->:UpdateConfig<!-- --> OR logs.alerts<!-- -->:UpdateConfig<!-- --> OR metrics.alerts<!-- -->:UpdateConfig<!-- --> OR spans.alerts<!-- -->:UpdateConfig |
| SetActive       | alerts<!-- -->:UpdateConfig<!-- --> OR logs.alerts<!-- -->:UpdateConfig<!-- --> OR metrics.alerts<!-- -->:UpdateConfig<!-- --> OR spans.alerts<!-- -->:UpdateConfig |

### Example[​](#example "Direct link to Example")

Use your customized API key in the Authorization request header to successfully connect.

```
grpcurl -H "Authorization: Bearer API_KEY_HERE"
```

Then, structure your header by using the <!-- -->api.:443<!-- --> endpoint for your Coralogix domain. To dynamically display the correct endpoint, use the domain selector at the top of the page.

```
-d @ api.eu2.coralogix.com:443
```

For the AlertDefs Service API, the service name is `AlertDefsService`.

```
com.coralogixapis.alerts.v3.AlertDefsService
```

The complete request header must look like this:

```
grpcurl -H "Authorization: Bearer API_KEY_HERE" -d @ api.eu2.coralogix.com:443 com.coralogixapis.alerts.v3.AlertDefsService/
```

## API functions[​](#api-functions "Direct link to API functions")

Find details on API functions in the [Alert definitions API reference](https://docs-docusaurus.kinsta.page/api-reference/v5/alert-definitions-service/overview/.md).

## Request structure summary[​](#request-structure-summary "Direct link to Request structure summary")

| Method                                                                                                                                                                              | Fields        | Type   | Required | Request Body Format           | Notes                           |
| ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------- | ------ | -------- | ----------------------------- | ------------------------------- |
| [**CreateAlertDef**](https://docs-docusaurus.kinsta.page/developer-portal/apis/data-management/alerts-api/alerts-grpc-api/.md#create-a-standard-alert-with-immediate-notifications) | *JSON object* | varies | Yes      | `-d '{ ... }'`                | Structure depends on alert type |
| [**ListAlertDefs**](https://docs-docusaurus.kinsta.page/developer-portal/apis/data-management/alerts-api/alerts-grpc-api/.md#list-alerts)                                           | *(none)*      | -      | -        | `-d ''`                       | Empty request body              |
| [**GetAlertDef**](https://docs-docusaurus.kinsta.page/developer-portal/apis/data-management/alerts-api/alerts-grpc-api/.md#get-alert)                                               | `id`          | string | Yes      | `-d '{ "id": "<alert_id>" }'` | -                               |

## Data sources[​](#data-sources "Direct link to Data sources")

Use the optional `data_sources` field on `alert_def_properties` to control which log data source the system uses to evaluate an alert.

If you do not specify `data_sources`, the alert behaves exactly as before. The system evaluates it against the default logs source:

* `data_space = "default"`
* `data_set = "logs"`

This ensures full backward compatibility with existing alert definitions.

```
{

  "alert_def_properties": {

    "name": "logs threshold",

    "type": "ALERT_DEF_TYPE_LOGS_THRESHOLD",

    "data_sources": [

      {

        "data_space": "default",

        "data_set": "logs"

      }

    ]

  }

}
```

### Field structure[​](#field-structure "Direct link to Field structure")

`data_sources` is an array of data source objects:

| **Field**      | **Type** | **Required** | **Description**                        |
| -------------- | -------- | ------------ | -------------------------------------- |
| `data_sources` | array    | No           | The sources from which to sample logs. |

Each data source object has the following fields:

| **Field**    | **Type** | **Required** | **Description**                 | **Notes**                            |
| ------------ | -------- | ------------ | ------------------------------- | ------------------------------------ |
| `data_space` | string   | No           | Folder name of the data source. | Allowed values: `default`, `system`. |
| `data_set`   | string   | No           | File name of the dataset.       | Example: `logs`.                     |

Note

Although `data_sources` is an array, the system currently supports only 1 data source. If you provide multiple entries, the system might reject the request.

### Behavior and defaults[​](#behavior-and-defaults "Direct link to Behavior and defaults")

* If you do not provide `data_sources`, the alert behaves as before. The system evaluates it using the default logs data source:

  * `data_space = "default"`
  * `data_set = "logs"`

* If you provide `data_sources`, the alert uses the single data source entry you specify. Providing more than 1 entry is not supported and might cause a validation error.

* `data_sources` currently applies to log-based alert types (for example: immediate, threshold, ratio, time-relative, anomaly, new value, unique count).

  For other alert types (metrics, tracing, flow), this field is currently ignored.

Note

In the alerts UI, `data_sources` corresponds to selecting a **Dataspace** and **Dataset** in the **Datasources** section of an alert definition.

For a conceptual overview and step-by-step UI workflow, see [Dataset alerts](https://docs-docusaurus.kinsta.page/user-guides/alerting/create-an-alert/logs/dataset-alerts/.md).

## Sample requests[​](#sample-requests "Direct link to Sample requests")

The following section presents an array of sample requests.

## Get alert[​](#get-alert "Direct link to Get alert")

This method expects an `id` field in the request body. For example: `{ "id": "<alert_id>"}`.

```
grpcurl -H "Authorization: Bearer API_KEY_HERE" -d @ api.eu2.coralogix.com:443 com.coralogixapis.alerts.v3.AlertDefsService/GetAlertDef <<EOF

{ "id": "786cf44e-13a7-475b-b089-d18a68a61236"}

EOF
```

Alternative syntax:

```
grpcurl -H "Authorization: Bearer API_KEY_HERE" -d '{ "id": "786cf44e-13a7-475b-b089-d18a68a61236"}' api.eu2.coralogix.com:443 com.coralogixapis.alerts.v3.AlertDefsService/GetAlertDef
```

Note

The `-d` flag specifies the request body in JSON format. Use single quotes to wrap the JSON string when passing it inline. To read from standard input, set `-d @` and provide the body using heredoc (<\<EOF).

## Activate or deactivate an alert[​](#activate-or-deactivate-an-alert "Direct link to Activate or deactivate an alert")

Use the `SetActive` method to activate or deactivate an existing alert definition by ID.

### Request[​](#request "Direct link to Request")

```
grpcurl \

  -H "Authorization: Bearer API_KEY_HERE" \

  -d '{"id": "4b27e05f-b418-4ac3-bb03-afbba9808277", "active": true}' \

  ng-api-grpc.us1.coralogix.com:443 \

  com.coralogixapis.alerts.v3.AlertDefsService/SetActive

EOF
```

## Create a standard alert with immediate notifications[​](#create-a-standard-alert-with-immediate-notifications "Direct link to Create a standard alert with immediate notifications")

Create a [Standard Alert](https://docs-docusaurus.kinsta.page/user-guides/alerting/create-an-alert/logs/threshold-alerts/.md) with the "notify immediately" condition.

### Request[​](#request-1 "Direct link to Request")

```
grpcurl -H "Authorization: Bearer API_KEY_HERE" -d @ api.eu2.coralogix.com:443 com.coralogixapis.alerts.v3.AlertDefsService/CreateAlertDef <<EOF
```

```
{

    "alert_def_properties": {

        "name": "logs-immediate",

        "description":"Example of logs-immediate alert",

        "enabled":  true,

        "priority": "ALERT_DEF_PRIORITY_P3",

        "type": "ALERT_DEF_TYPE_LOGS_IMMEDIATE_OR_UNSPECIFIED",

        "data_sources": [

          {

          "data_space": "default",

          "data_set": "logs"

          }

    ],

        "entity_labels": {

            "label_key":"label_value"

        },

        "incidents_settings": {

            "notify_on": "NOTIFY_ON_TRIGGERED_AND_RESOLVED",

            "minutes": 10

        },

        "notification_group": {

            "group_by_keys": [],

            "webhooks": [{

               "minutes":10,

               "notify_on":"NOTIFY_ON_TRIGGERED_AND_RESOLVED",

                "integration": {

                    "recipients": {"emails": ["example@coralogix.com"]}

                }

            }]

        },

        "logs_immediate": {

            "logs_filter": {

                "simple_filter": {

                    "label_filters": {

                        "application_name": [

                            {

                                "operation": "LOG_FILTER_OPERATION_TYPE_ENDS_WITH",

                                "value": "endsWithThis"

                            }

                        ],

                        "severities": [

                            "LOG_SEVERITY_ERROR",

                            "LOG_SEVERITY_CRITICAL"

                        ]

                    },

                    "lucene_query": "QueryThisLog"

                }

            }

        }

    }

}

EOF
```

### Response[​](#response "Direct link to Response")

```
{

  "alertDef": {

    "alertDefProperties": {

      "name": "logs-immediate",

      "description": "Example of logs-immediate alert",

      "enabled": true,

      "priority": "ALERT_DEF_PRIORITY_P3",

      "incidentsSettings": {

        "notifyOn": "NOTIFY_ON_TRIGGERED_AND_RESOLVED",

        "minutes": 10

      },

      "notificationGroup": {

        "webhooks": [

          {

            "notifyOn": "NOTIFY_ON_TRIGGERED_AND_RESOLVED",

            "integration": {

              "recipients": {

                "emails": [

                  "example@coralogix.com"

                ]

              }

            },

            "minutes": 10

          }

        ]

      },

      "entityLabels": {

        "label_key": "label_value"

      },

      "phantomMode": false,

      "deleted": false,

      "logsImmediate": {

        "logsFilter": {

          "simpleFilter": {

            "luceneQuery": "QueryThisLog",

            "labelFilters": {

              "applicationName": [

                {

                  "value": "endsWithThis",

                  "operation": "LOG_FILTER_OPERATION_TYPE_ENDS_WITH"

                }

              ],

              "severities": [

                "LOG_SEVERITY_ERROR",

                "LOG_SEVERITY_CRITICAL"

              ]

            }

          }

        }

      }

    },

    "id": "737d508f-8961-45bc-941c-356aa112e9bc",

    "createdTime": "2024-11-06T08:02:20Z",

    "updatedTime": "2024-11-06T08:02:20Z",

    "alertVersionId": "737d508f-8961-45bc-941c-356aa112e9bc"

  }

}
```

## Create a standard alert with a threshold[​](#create-a-standard-alert-with-a-threshold "Direct link to Create a standard alert with a threshold")

Create a [Standard Alert](https://docs-docusaurus.kinsta.page/user-guides/alerting/create-an-alert/logs/threshold-alerts/.md) with the "more than" or "less than" condition.

### Request[​](#request-2 "Direct link to Request")

```
grpcurl -H "Authorization: Bearer API_KEY_HERE" -d @ api.eu2.coralogix.com:443 com.coralogixapis.alerts.v3.AlertDefsService/CreateAlertDef <<EOF
```

```
{

    "alert_def_properties": {

        "name": "logs threshold",

        "description": "example of logs threshold",

        "priority": "ALERT_DEF_PRIORITY_P2",

        "enabled":  true,

        "incidents_settings": {

            "notify_on": "NOTIFY_ON_TRIGGERED_AND_RESOLVED",

            "minutes": 10

        },

        "entity_labels": {

            "key": "value"

        },

        "type": "ALERT_DEF_TYPE_LOGS_THRESHOLD",

        "logs_threshold": {

            "logs_filter": {

                "simple_filter": {

                    "lucene_query": "_exists_:field",

                    "label_filters": {

                        "application_name": [],

                        "severities": [],

                        "subsystem_name": []

                    }

                }

            },

            "notification_payload_filter": [],

            "rules": [

                {

                    "condition": {

                        "condition_type": "LOGS_THRESHOLD_CONDITION_TYPE_MORE_THAN_OR_UNSPECIFIED",

                        "threshold": 1000,

                        "time_window": {

                            "logs_time_window_specific_value": "LOGS_TIME_WINDOW_VALUE_HOURS_2"

                        }

                    },

                    "override": {

                        "priority": "ALERT_DEF_PRIORITY_P2"

                    }

                }

            ]

        }

    }

}

EOF
```

### Response[​](#response-1 "Direct link to Response")

```
{

  "alertDef": {

    "alertDefProperties": {

      "name": "logs threshold",

      "description": "example of logs threshold",

      "enabled": true,

      "priority": "ALERT_DEF_PRIORITY_P2",

      "type": "ALERT_DEF_TYPE_LOGS_THRESHOLD",

      "incidentsSettings": {

        "notifyOn": "NOTIFY_ON_TRIGGERED_AND_RESOLVED",

        "minutes": 10

      },

      "notificationGroup": {

      },

      "entityLabels": {

        "key": "value"

      },

      "phantomMode": false,

      "deleted": false,

      "logsThreshold": {

        "logsFilter": {

          "simpleFilter": {

            "luceneQuery": "_exists_:field",

            "labelFilters": {

            }

          }

        },

        "rules": [

          {

            "condition": {

              "threshold": 1000,

              "timeWindow": {

                "logsTimeWindowSpecificValue": "LOGS_TIME_WINDOW_VALUE_HOURS_2"

              }

            },

            "override": {

              "priority": "ALERT_DEF_PRIORITY_P2"

            }

          }

        ]

      }

    },

    "id": "cb7e34ab-26a5-426e-b069-272eebc7b2bf",

    "createdTime": "2024-11-06T08:15:01Z",

    "updatedTime": "2024-11-06T08:15:01Z",

    "alertVersionId": "cb7e34ab-26a5-426e-b069-272eebc7b2bf"

  }

}
```

## Create a dataset alert with a threshold[​](#create-a-dataset-alert-with-a-threshold "Direct link to Create a dataset alert with a threshold")

Create a logs-based threshold alert evaluated on a **specific dataset** instead of the default `default/logs`. This example uses the `data_sources` field to target the `system/notification.deliveries` dataset.

### Request[​](#request-3 "Direct link to Request")

```
grpcurl -H "Authorization: Bearer API_KEY_HERE" -d @ \

  api.eu2.coralogix.com:443 \

  com.coralogixapis.alerts.v3.AlertDefsService/CreateAlertDef <<EOF

{

  "alert_def_properties": {

    "name": "notification delivery failures",

    "description": "Threshold alert on system/notification.deliveries",

    "priority": "ALERT_DEF_PRIORITY_P2",

    "enabled": true,

    "incidents_settings": {

      "notify_on": "NOTIFY_ON_TRIGGERED_AND_RESOLVED",

      "minutes": 10

    },

    "entity_labels": {

      "team": "sre"

    },

    "type": "ALERT_DEF_TYPE_LOGS_THRESHOLD",

    "data_sources": [

      {

        "data_space": "system",

        "data_set": "notification.deliveries"

      }

    ],

    "logs_threshold": {

      "logs_filter": {

        "simple_filter": {

          "lucene_query": "status:failed AND target_type:slack",

          "label_filters": { }

        }

      },

      "rules": [

        {

          "condition": {

            "threshold": 50,

            "time_window": {

              "logs_time_window_specific_value": "LOGS_TIME_WINDOW_VALUE_MINUTES_15"

            }

          },

          "override": {

            "priority": "ALERT_DEF_PRIORITY_P1"

          }

        }

      ]

    }

  }

}
```

### **Response**[​](#response-2 "Direct link to response-2")

```
{

  "alertDef": {

    "alertDefProperties": {

      "name": "notification delivery failures",

      "description": "Threshold alert on system/notification.deliveries",

      "enabled": true,

      "priority": "ALERT_DEF_PRIORITY_P1",

      "type": "ALERT_DEF_TYPE_LOGS_THRESHOLD",

      "incidentsSettings": {

        "notifyOn": "NOTIFY_ON_TRIGGERED_AND_RESOLVED",

        "minutes": 10

      },

      "notificationGroup": {},

      "entityLabels": {

        "team": "sre"

      },

      "phantomMode": false,

      "deleted": false,

      "logsThreshold": {

        "logsFilter": {

          "simpleFilter": {

            "luceneQuery": "status:failed AND target_type:slack",

            "labelFilters": {}

          }

        },

        "rules": [

          {

            "condition": {

              "threshold": 50,

              "timeWindow": {

                "logsTimeWindowSpecificValue": "LOGS_TIME_WINDOW_VALUE_MINUTES_15"

              }

            },

            "override": {

              "priority": "ALERT_DEF_PRIORITY_P1"

            }

          }

        ]

      },

      "dataSources": [

        {

          "dataSpace": "system",

          "dataSet": "notification.deliveries"

        }

      ]

    },

    "id": "XXXXXXXXXXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX",

    "createdTime": "2024-11-06T08:30:00Z",

    "updatedTime": "2024-11-06T08:30:00Z",

    "alertVersionId": "XXXXXXXXXXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX"

  }

}
```

## Create a ratio alert[​](#create-a-ratio-alert "Direct link to Create a ratio alert")

Create a [Ratio Alert](https://docs-docusaurus.kinsta.page/user-guides/alerting/create-an-alert/logs/ratio-alerts/.md).

### Request[​](#request-4 "Direct link to Request")

```
  grpcurl -H "Authorization: Bearer API_KEY_HERE" -d @ api.eu2.coralogix.com:443 com.coralogixapis.alerts.v3.AlertDefsService/CreateAlertDef <<EOF
```

```
{

    "alert_def_properties": {

        "name": "logs ratio threshold",

        "description": "example of logs ratio threshold",

        "priority": "ALERT_DEF_PRIORITY_P2",

        "enabled": true,

        "incidents_settings": {

            "notify_on": "NOTIFY_ON_TRIGGERED_AND_RESOLVED",

            "minutes":  10

        },

        "group_by_keys": ["application_name"],

        "type": "ALERT_DEF_TYPE_LOGS_RATIO_THRESHOLD",

        "logs_ratio_threshold": {

            "numerator": {

                "simple_filter": {

                    "label_filters": {"application_name": [],"severities": [],"subsystem_name": []},

                    "lucene_query":  "_exists_:field"

                }

            },

            "denominator": {

                "simple_filter": {

                    "label_filters": {"application_name": [],"severities": [],"subsystem_name": []},

                    "lucene_query": "_exists_:field2"

                }

            },

            "numerator_alias":"First Query",

            "denominator_alias":"Second Query",

            "notification_payload_filter": [],

            "ignore_infinity": false,

            "group_by_for": "LOGS_RATIO_GROUP_BY_FOR_NUMERATOR_ONLY",

            "rules": [

                {

                    "condition": {

                        "condition_type": "LOGS_RATIO_CONDITION_TYPE_MORE_THAN_OR_UNSPECIFIED",

                        "threshold": 1000,

                        "time_window": {

                            "logs_ratio_time_window_specific_value": "LOGS_RATIO_TIME_WINDOW_VALUE_HOURS_2"

                        }

                    },

                    "override": {

                        "priority": "ALERT_DEF_PRIORITY_P2"

                    }

                }

            ]

        }

    }

}
```

### Response[​](#response-3 "Direct link to Response")

```
{

  "alertDef": {

    "alertDefProperties": {

      "name": "logs ratio threshold",

      "description": "example of logs ratio threshold",

      "enabled": true,

      "priority": "ALERT_DEF_PRIORITY_P2",

      "type": "ALERT_DEF_TYPE_LOGS_RATIO_THRESHOLD",

      "groupByKeys": [

        "application_name"

      ],

      "incidentsSettings": {

        "notifyOn": "NOTIFY_ON_TRIGGERED_AND_RESOLVED",

        "minutes": 10

      },

      "notificationGroup": {



      },

      "phantomMode": false,

      "deleted": false,

      "logsRatioThreshold": {

        "numerator": {

          "simpleFilter": {

            "luceneQuery": "_exists_:field",

            "labelFilters": {



            }

          }

        },

        "numeratorAlias": "First Query",

        "denominator": {

          "simpleFilter": {

            "luceneQuery": "_exists_:field2",

            "labelFilters": {



            }

          }

        },

        "denominatorAlias": "Second Query",

        "rules": [

          {

            "condition": {

              "threshold": 1000,

              "timeWindow": {

                "logsRatioTimeWindowSpecificValue": "LOGS_RATIO_TIME_WINDOW_VALUE_HOURS_2"

              }

            },

            "override": {

              "priority": "ALERT_DEF_PRIORITY_P2"

            }

          }

        ],

        "groupByFor": "LOGS_RATIO_GROUP_BY_FOR_NUMERATOR_ONLY",

        "ignoreInfinity": false

      }

    },

    "id": "071aeed5-66cd-4218-874d-41eae5ef4140",

    "createdTime": "2024-11-06T08:20:52Z",

    "updatedTime": "2024-11-06T08:20:52Z",

    "alertVersionId": "071aeed5-66cd-4218-874d-41eae5ef4140"

  }

}
```

## Create a time relative alert[​](#create-a-time-relative-alert "Direct link to Create a time relative alert")

Create a [Time Relative Alert](https://docs-docusaurus.kinsta.page/user-guides/alerting/create-an-alert/logs/time-relative-alerts/.md).

### Request[​](#request-5 "Direct link to Request")

```
grpcurl -H "Authorization: Bearer API_KEY_HERE" -d @ api.eu2.coralogix.com:443 com.coralogixapis.alerts.v3.AlertDefsService/CreateAlertDef <<EOF
```

```
{

    "alert_def_properties": {

        "name": "logs time relative threshold",

        "description": "example of logs time relative threshold",

        "priority": "ALERT_DEF_PRIORITY_P2",

        "enabled": true,

        "incidents_settings": {

            "notify_on": "NOTIFY_ON_TRIGGERED_AND_RESOLVED",

            "minutes":  10

        },

        "type": "ALERT_DEF_TYPE_LOGS_TIME_RELATIVE_THRESHOLD",

        "logs_time_relative_threshold": {

            "logs_filter": {

                "simple_filter": {

                    "label_filters": {"application_name": [],"severities": [],"subsystem_name": []},

                    "lucene_query": "_exists_:field"

                }

            },

            "notification_payload_filter": [],

            "ignore_infinity": true,

            "rules": [

                {

                    "condition": {

                        "condition_type": "LOGS_TIME_RELATIVE_CONDITION_TYPE_LESS_THAN",

                       "compared_to": "LOGS_TIME_RELATIVE_COMPARED_TO_SAME_DAY_LAST_WEEK",

                       "threshold": 5

                    },

                    "override": {

                        "priority": "ALERT_DEF_PRIORITY_P2"

                    }

                }

            ]

        }

    }

}

EOF
```

### Response[​](#response-4 "Direct link to Response")

```
{

  "alertDef": {

    "alertDefProperties": {

      "name": "logs time relative threshold",

      "description": "example of logs time relative threshold",

      "enabled": true,

      "priority": "ALERT_DEF_PRIORITY_P2",

      "type": "ALERT_DEF_TYPE_LOGS_TIME_RELATIVE_THRESHOLD",

      "incidentsSettings": {

        "notifyOn": "NOTIFY_ON_TRIGGERED_AND_RESOLVED",

        "minutes": 10

      },

      "notificationGroup": {



      },

      "phantomMode": false,

      "deleted": false,

      "logsTimeRelativeThreshold": {

        "logsFilter": {

          "simpleFilter": {

            "luceneQuery": "_exists_:field",

            "labelFilters": {



            }

          }

        },

        "rules": [

          {

            "condition": {

              "threshold": 5,

              "comparedTo": "LOGS_TIME_RELATIVE_COMPARED_TO_SAME_DAY_LAST_WEEK",

              "conditionType": "LOGS_TIME_RELATIVE_CONDITION_TYPE_LESS_THAN"

            },

            "override": {

              "priority": "ALERT_DEF_PRIORITY_P2"

            }

          }

        ],

        "ignoreInfinity": true,

        "undetectedValuesManagement": {

          "triggerUndetectedValues": false,

          "autoRetireTimeframe": "AUTO_RETIRE_TIMEFRAME_NEVER_OR_UNSPECIFIED"

        }

      }

    },

    "id": "a5de559e-b940-4283-8ad6-2ddc77701049",

    "createdTime": "2024-11-06T08:22:52Z",

    "updatedTime": "2024-11-06T08:22:52Z",

    "alertVersionId": "a5de559e-b940-4283-8ad6-2ddc77701049"

  }

}
```

## Create a log-based anomaly alert[​](#create-a-log-based-anomaly-alert "Direct link to Create a log-based anomaly alert")

Create a log-based anomaly [alert](https://docs-docusaurus.kinsta.page/user-guides/alerting/create-an-alert/logs/anomaly-detection-alerts/.md) to measure [more-than-usual anomalies](https://docs-docusaurus.kinsta.page/user-guides/alerting/create-an-alert/logs/anomaly-detection-alerts/.md).

### Request[​](#request-6 "Direct link to Request")

```
grpcurl -H "Authorization: Bearer API_KEY_HERE" -d @ api.eu2.coralogix.com:443 com.coralogixapis.alerts.v3.AlertDefsService/CreateAlertDef <<EOF
```

```
{

    "alert_def_properties": {

        "name": "logs-anomaly-alert",

        "description": "Example of logs-anomaly alert",

        "enabled": true,

        "priority": "ALERT_DEF_PRIORITY_P3",

        "type": "ALERT_DEF_TYPE_LOGS_ANOMALY",

        "incidents_settings": {

            "notify_on": "NOTIFY_ON_TRIGGERED_AND_RESOLVED",

            "minutes":  60

        },

        "notification_group": {

            "group_by_keys": [],

            "webhooks": [

                {

                    "notify_on": "NOTIFY_ON_TRIGGERED_AND_RESOLVED",

                    "integration": {

                        "recipients": {"emails": ["example@coralogix.com"]}

                    },

                    "minutes": 60

                }

            ]

        },

        "logs_anomaly": {

            "rules": [

                {

                    "condition": {

                        "minimum_threshold":  1000,

                        "time_window": {

                            "logs_time_window_specific_value": "LOGS_TIME_WINDOW_VALUE_HOURS_24"

                        },

                        "condition_type": "LOGS_ANOMALY_CONDITION_TYPE_MORE_THAN_USUAL_OR_UNSPECIFIED"

                    }

                }

            ],

            "logs_filter": {

                "simple_filter": {

                    "label_filters": {

                        "subsystem_name": [

                            {

                                "operation": "LOG_FILTER_OPERATION_TYPE_INCLUDES",

                                "value": "includes"

                            }

                        ]

                    },

                    "lucene_query": "QueryThisLog && This Log"

                }

            }

        }

    }

}

EOF
```

### Response[​](#response-5 "Direct link to Response")

```
{

  "alertDef": {

    "alertDefProperties": {

      "name": "logs-anomaly-alert",

      "description": "Example of logs-anomaly alert",

      "enabled": true,

      "priority": "ALERT_DEF_PRIORITY_P3",

      "type": "ALERT_DEF_TYPE_LOGS_ANOMALY",

      "incidentsSettings": {

        "notifyOn": "NOTIFY_ON_TRIGGERED_AND_RESOLVED",

        "minutes": 60

      },

      "notificationGroup": {

        "webhooks": [

          {

            "notifyOn": "NOTIFY_ON_TRIGGERED_AND_RESOLVED",

            "integration": {

              "recipients": {

                "emails": [

                  "example@coralogix.com"

                ]

              }

            },

            "minutes": 60

          }

        ]

      },

      "phantomMode": false,

      "deleted": false,

      "logsAnomaly": {

        "logsFilter": {

          "simpleFilter": {

            "luceneQuery": "QueryThisLog \u0026\u0026 This Log",

            "labelFilters": {

              "subsystemName": [

                {

                  "value": "includes",

                  "operation": "LOG_FILTER_OPERATION_TYPE_INCLUDES"

                }

              ]

            }

          }

        },

        "rules": [

          {

            "condition": {

              "minimumThreshold": 1000,

              "timeWindow": {

                "logsTimeWindowSpecificValue": "LOGS_TIME_WINDOW_VALUE_HOURS_24"

              }

            }

          }

        ]

      }

    },

    "id": "5bc8712b-ae0c-4d49-9cd2-1cc374eddfb7",

    "createdTime": "2024-11-06T08:46:10Z",

    "updatedTime": "2024-11-06T08:46:10Z",

    "alertVersionId": "5bc8712b-ae0c-4d49-9cd2-1cc374eddfb7"

  }

}
```

## Create a new value alert[​](#create-a-new-value-alert "Direct link to Create a new value alert")

Create a [New Value Alert](https://docs-docusaurus.kinsta.page/user-guides/alerting/create-an-alert/logs/new-value-alerts/.md).

### Request[​](#request-7 "Direct link to Request")

```
grpcurl -H "Authorization: Bearer API_KEY_HERE" -d @ api.eu2.coralogix.com:443 com.coralogixapis.alerts.v3.AlertDefsService/CreateAlertDef <<EOF
```

```
{

    "alert_def_properties": {

        "name": "logs new value",

        "description": "example of logs new value",

        "priority": "ALERT_DEF_PRIORITY_P3",

        "enabled":  true,

        "incidents_settings": {

            "notify_on": "NOTIFY_ON_TRIGGERED_AND_RESOLVED",

            "minutes": 10

        },

        "entity_labels": {

            "my_key": "my_label"

        },

        "type": "ALERT_DEF_TYPE_LOGS_NEW_VALUE",

        "logs_new_value": {

            "logs_filter": {

                "simple_filter": {

                    "label_filters": {

                        "application_name": [],

                        "severities": [],

                        "subsystem_name": []

                    },

                    "lucene_query":  "_exists_:field"

                }

            },

            "notification_payload_filter": [],

            "rules": [

                {

                    "condition": {

                        "keypath_to_track": "keypath",

                        "time_window": {

                            "logs_new_value_time_window_specific_value": "LOGS_NEW_VALUE_TIME_WINDOW_VALUE_HOURS_24"

                        }

                    }

                }

            ]

        }

    }

}

EOF
```

### Response[​](#response-6 "Direct link to Response")

```
{

  "alertDef": {

    "alertDefProperties": {

      "name": "logs new value",

      "description": "example of logs new value",

      "enabled": true,

      "priority": "ALERT_DEF_PRIORITY_P3",

      "type": "ALERT_DEF_TYPE_LOGS_NEW_VALUE",

      "incidentsSettings": {

        "notifyOn": "NOTIFY_ON_TRIGGERED_AND_RESOLVED",

        "minutes": 10

      },

      "notificationGroup": {



      },

      "entityLabels": {

        "my_key": "my_label"

      },

      "phantomMode": false,

      "deleted": false,

      "logsNewValue": {

        "logsFilter": {

          "simpleFilter": {

            "luceneQuery": "_exists_:field",

            "labelFilters": {



            }

          }

        },

        "rules": [

          {

            "condition": {

              "keypathToTrack": "keypath",

              "timeWindow": {

                "logsNewValueTimeWindowSpecificValue": "LOGS_NEW_VALUE_TIME_WINDOW_VALUE_HOURS_24"

              }

            }

          }

        ]

      }

    },

    "id": "5722397b-0251-4832-83b7-e8e16dfd7c92",

    "createdTime": "2024-11-06T08:48:07Z",

    "updatedTime": "2024-11-06T08:48:07Z",

    "alertVersionId": "5722397b-0251-4832-83b7-e8e16dfd7c92"

  }

}
```

## Create a unique count alert[​](#create-a-unique-count-alert "Direct link to Create a unique count alert")

Create a [Unique Count Alert](https://docs-docusaurus.kinsta.page/user-guides/alerting/create-an-alert/logs/unique-count-alerts/.md).

### Request[​](#request-8 "Direct link to Request")

```
grpcurl -H "Authorization: Bearer API_KEY_HERE" -d @ api.eu2.coralogix.com:443 com.coralogixapis.alerts.v3.AlertDefsService/CreateAlertDef <<EOF
```

```
{

    "alert_def_properties": {

        "name": "logs unique count",

        "description": "example of logs unique count",

        "priority": "ALERT_DEF_PRIORITY_P4",

        "enabled": true,

        "group_by_keys": ["logobj.path"],

        "incidents_settings": {

            "notify_on": "NOTIFY_ON_TRIGGERED_AND_RESOLVED",

            "minutes": 10

        },

        "type": "ALERT_DEF_TYPE_LOGS_UNIQUE_COUNT",

        "logs_unique_count": {

            "logs_filter": {

                "simple_filter": {

                    "label_filters": {

                        "application_name": [],

                        "severities": [],

                        "subsystem_name": []

                    },

                    "lucene_query": "_exists_:field"

                }

            },

            "notification_payload_filter": [],

            "unique_count_keypath": "keypath",

            "max_unique_count_per_group_by_key": "100",

            "rules": [

                {

                    "condition": {

                        "max_unique_count": "100",

                        "time_window": {

                            "logs_unique_value_time_window_specific_value": "LOGS_UNIQUE_VALUE_TIME_WINDOW_VALUE_HOURS_12"

                        }

                    }

                }

            ]

        }

    }

}

EOF
```

### Response[​](#response-7 "Direct link to Response")

```
{

  "alertDef": {

    "alertDefProperties": {

      "name": "logs unique count",

      "description": "example of logs unique count",

      "enabled": true,

      "priority": "ALERT_DEF_PRIORITY_P4",

      "type": "ALERT_DEF_TYPE_LOGS_UNIQUE_COUNT",

      "groupByKeys": [

        "logobj.path"

      ],

      "incidentsSettings": {

        "notifyOn": "NOTIFY_ON_TRIGGERED_AND_RESOLVED",

        "minutes": 10

      },

      "notificationGroup": {



      },

      "phantomMode": false,

      "deleted": false,

      "logsUniqueCount": {

        "logsFilter": {

          "simpleFilter": {

            "luceneQuery": "_exists_:field",

            "labelFilters": {



            }

          }

        },

        "rules": [

          {

            "condition": {

              "maxUniqueCount": "100",

              "timeWindow": {

                "logsUniqueValueTimeWindowSpecificValue": "LOGS_UNIQUE_VALUE_TIME_WINDOW_VALUE_HOURS_12"

              }

            }

          }

        ],

        "maxUniqueCountPerGroupByKey": "100",

        "uniqueCountKeypath": "keypath"

      }

    },

    "id": "1ee21858-a338-4c22-a42c-205c3e76544b",

    "createdTime": "2024-11-06T08:50:04Z",

    "updatedTime": "2024-11-06T08:50:04Z",

    "alertVersionId": "1ee21858-a338-4c22-a42c-205c3e76544b"

  }

}
```

## Create a metric alert with a threshold[​](#create-a-metric-alert-with-a-threshold "Direct link to Create a metric alert with a threshold")

Create a [Metric Alert](https://docs-docusaurus.kinsta.page/user-guides/alerting/create-an-alert/metrics/threshold-alerts/.md) with a "less than or equals" condition.

### Request[​](#request-9 "Direct link to Request")

```
grpcurl -H "Authorization: Bearer API_KEY_HERE" -d @ api.eu2.coralogix.com:443 com.coralogixapis.alerts.v3.AlertDefsService/CreateAlertDef <<EOF
```

```
{

    "alert_def_properties": {

        "name": "metrics threshold",

        "description": "example of metrics threshold",

        "priority": "ALERT_DEF_PRIORITY_P2",

        "enabled": true,

        "incidents_settings": {

            "notify_on": "NOTIFY_ON_TRIGGERED_AND_RESOLVED",

            "minutes": 10

        },

        "type": "ALERT_DEF_TYPE_METRIC_THRESHOLD",

        "metric_threshold": {

            "metric_filter": {

                "promql": "sum(http_requests_total{job=\"api-server\"}) by (job)"

            },

            "missing_values": {"replace_with_zero": true},

            "rules": [{

                "condition": {

                    "condition_type": "METRIC_THRESHOLD_CONDITION_TYPE_LESS_THAN_OR_EQUALS",

                    "for_over_pct": 80,

                    "of_the_last": {"metric_time_window_specific_value": "METRIC_TIME_WINDOW_VALUE_HOUR_1"},

                    "threshold": 5000

                },

                "override": {

                    "priority": "ALERT_DEF_PRIORITY_P2"

                }

            }],

            "undetected_values_management": {

                "trigger_undetected_values": true,

                "auto_retire_timeframe": "AUTO_RETIRE_TIMEFRAME_HOURS_24"

            }

        }

    }

}

EOF
```

### Response[​](#response-8 "Direct link to Response")

```
{

  "alertDef": {

    "alertDefProperties": {

      "name": "metrics threshold",

      "description": "example of metrics threshold",

      "enabled": true,

      "priority": "ALERT_DEF_PRIORITY_P2",

      "type": "ALERT_DEF_TYPE_METRIC_THRESHOLD",

      "incidentsSettings": {

        "notifyOn": "NOTIFY_ON_TRIGGERED_AND_RESOLVED",

        "minutes": 10

      },

      "notificationGroup": {



      },

      "phantomMode": false,

      "deleted": false,

      "metricThreshold": {

        "metricFilter": {

          "promql": "sum(http_requests_total{job=\"api-server\"}) by (job)"

        },

        "rules": [

          {

            "condition": {

              "threshold": 5000,

              "forOverPct": 80,

              "ofTheLast": {

                "metricTimeWindowSpecificValue": "METRIC_TIME_WINDOW_VALUE_HOUR_1"

              },

              "conditionType": "METRIC_THRESHOLD_CONDITION_TYPE_LESS_THAN_OR_EQUALS"

            },

            "override": {

              "priority": "ALERT_DEF_PRIORITY_P2"

            }

          }

        ],

        "undetectedValuesManagement": {

          "triggerUndetectedValues": true,

          "autoRetireTimeframe": "AUTO_RETIRE_TIMEFRAME_HOURS_24"

        },

        "missingValues": {

          "replaceWithZero": true

        }

      }

    },

    "id": "bb835aa2-7462-4d39-903b-9eab7dbaf1ca",

    "createdTime": "2024-11-06T09:01:12Z",

    "updatedTime": "2024-11-06T09:01:12Z",

    "alertVersionId": "bb835aa2-7462-4d39-903b-9eab7dbaf1ca"

  }

}
```

## Create a metric-based anomaly alert[​](#create-a-metric-based-anomaly-alert "Direct link to Create a metric-based anomaly alert")

Create a metric-based Anomaly [Alert](https://docs-docusaurus.kinsta.page/user-guides/alerting/create-an-alert/metrics/anomaly-detection-alerts/.md) to measure [more-than-usual anomalies](https://docs-docusaurus.kinsta.page/user-guides/alerting/create-an-alert/metrics/anomaly-detection-alerts/.md).

### Request[​](#request-10 "Direct link to Request")

```
grpcurl -H "Authorization: Bearer API_KEY_HERE" -d @ api.eu2.coralogix.com:443 com.coralogixapis.alerts.v3.AlertDefsService/CreateAlertDef <<EOF
```

```
{

    "alert_def_properties": {

        "name": "metrics-anomaly alert",

        "description": "Example of metrics-anomaly alert",

        "enabled": true,

        "priority": "ALERT_DEF_PRIORITY_P3",

        "type": "ALERT_DEF_TYPE_METRIC_ANOMALY",

        "incidents_settings": {

            "notify_on": "NOTIFY_ON_TRIGGERED_AND_RESOLVED",

            "minutes":  5

        },

        "notification_group": {

            "group_by_keys": [],

            "webhooks": [

                {

                    "notify_on": "NOTIFY_ON_TRIGGERED_AND_RESOLVED",

                    "integration": {

                        "recipients": {

                            "emails": [ "example@coralogix.com"]

                        }

                    },

                    "minutes": 5

                }

            ]

        },

        "metric_anomaly": {

            "rules": [

                {

                    "condition": {

                        "for_over_pct": 5,

                        "of_the_last": {

                            "metric_time_window_specific_value": "METRIC_TIME_WINDOW_VALUE_HOURS_24"

                        },

                        "threshold": 100,

                        "min_non_null_values_pct": 50,

                        "condition_type": "METRIC_ANOMALY_CONDITION_TYPE_MORE_THAN_USUAL_OR_UNSPECIFIED"

                    }

                }

            ],

            "metric_filter": {

                "promql": "sum(cpu) by (pod)"

            }

        }

    }

}

EOF
```

### Response[​](#response-9 "Direct link to Response")

```
{

  "alertDef": {

    "alertDefProperties": {

      "name": "metrics-anomaly alert",

      "description": "Example of metrics-anomaly alert",

      "enabled": true,

      "priority": "ALERT_DEF_PRIORITY_P3",

      "type": "ALERT_DEF_TYPE_METRIC_ANOMALY",

      "incidentsSettings": {

        "notifyOn": "NOTIFY_ON_TRIGGERED_AND_RESOLVED",

        "minutes": 5

      },

      "notificationGroup": {

        "webhooks": [

          {

            "notifyOn": "NOTIFY_ON_TRIGGERED_AND_RESOLVED",

            "integration": {

              "recipients": {

                "emails": [

                  "example@coralogix.com"

                ]

              }

            },

            "minutes": 5

          }

        ]

      },

      "phantomMode": false,

      "deleted": false,

      "metricAnomaly": {

        "metricFilter": {

          "promql": "sum(cpu) by (pod)"

        },

        "rules": [

          {

            "condition": {

              "threshold": 100,

              "forOverPct": 5,

              "ofTheLast": {

                "metricTimeWindowSpecificValue": "METRIC_TIME_WINDOW_VALUE_HOURS_24"

              },

              "minNonNullValuesPct": 50

            }

          }

        ]

      }

    },

    "id": "42391e48-7996-4f7c-b7ca-8b359a012d7f",

    "createdTime": "2024-11-06T09:04:43Z",

    "updatedTime": "2024-11-06T09:04:43Z",

    "alertVersionId": "42391e48-7996-4f7c-b7ca-8b359a012d7f"

  }

}
```

## Create a tracing alert with immediate notifications[​](#create-a-tracing-alert-with-immediate-notifications "Direct link to Create a tracing alert with immediate notifications")

Create a [Tracing Alert](https://docs-docusaurus.kinsta.page/user-guides/alerting/create-an-alert/traces/tracing-alerts/.md) with the "notify immediately" condition.

### Request[​](#request-11 "Direct link to Request")

```
grpcurl -H "Authorization: Bearer API_KEY_HERE" -d @ api.eu2.coralogix.com:443 com.coralogixapis.alerts.v3.AlertDefsService/CreateAlertDef <<EOF
```

```
{

    "alert_def_properties": {

        "name":"tracing immediate alert",

        "description": "Example of tracing immediate alert",

        "enabled": true,

        "priority": "ALERT_DEF_PRIORITY_P4",

        "type": "ALERT_DEF_TYPE_TRACING_IMMEDIATE",

        "incidents_settings": {

            "notify_on": "NOTIFY_ON_TRIGGERED_AND_RESOLVED",

            "minutes": 10

        },

        "tracing_immediate": {

            "tracing_filter": {

                "simple_filter": {

                    "latency_threshold_ms": 3000,

                    "tracing_label_filters": {

                        "application_name": [{

                            "operation": "TRACING_FILTER_OPERATION_TYPE_INCLUDES",

                            "values": ["test"]

                        }]

                    }

                }

            }

        }

    }

}

EOF
```

### Response[​](#response-10 "Direct link to Response")

```
{

  "alertDef": {

    "alertDefProperties": {

      "name": "tracing immediate alert",

      "description": "Example of tracing immediate alert",

      "enabled": true,

      "priority": "ALERT_DEF_PRIORITY_P4",

      "type": "ALERT_DEF_TYPE_TRACING_IMMEDIATE",

      "incidentsSettings": {

        "notifyOn": "NOTIFY_ON_TRIGGERED_AND_RESOLVED",

        "minutes": 10

      },

      "notificationGroup": {



      },

      "phantomMode": false,

      "deleted": false,

      "tracingImmediate": {

        "tracingFilter": {

          "simpleFilter": {

            "tracingLabelFilters": {

              "applicationName": [

                {

                  "values": [

                    "test"

                  ],

                  "operation": "TRACING_FILTER_OPERATION_TYPE_INCLUDES"

                }

              ]

            },

            "latencyThresholdMs": 3000

          }

        }

      }

    },

    "id": "c71915ba-0854-4b8f-8522-885063b500d5",

    "createdTime": "2024-11-06T09:06:34Z",

    "updatedTime": "2024-11-06T09:06:34Z",

    "alertVersionId": "c71915ba-0854-4b8f-8522-885063b500d5"

  }

}
```

## Create a tracing alert with a threshold[​](#create-a-tracing-alert-with-a-threshold "Direct link to Create a tracing alert with a threshold")

Create a [Tracing Alert](https://docs-docusaurus.kinsta.page/user-guides/alerting/create-an-alert/traces/tracing-alerts/.md) with a "more than" condition.

### Request[​](#request-12 "Direct link to Request")

```
grpcurl -H "Authorization: Bearer API_KEY_HERE" -d @ api.eu2.coralogix.com:443 com.coralogixapis.alerts.v3.AlertDefsService/CreateAlertDef <<EOF
```

```
{

    "alert_def_properties": {

        "name":  "tracing threshold alert",

        "description": "Example of tracing threshold alert",

        "enabled":  true,

        "priority": "ALERT_DEF_PRIORITY_P4",

        "type": "ALERT_DEF_TYPE_TRACING_THRESHOLD",

        "incidents_settings": {

            "notify_on": "NOTIFY_ON_TRIGGERED_AND_RESOLVED",

            "minutes": 10

        },

        "entity_labels": {

            "key1": "value1"

        },

        "tracing_threshold": {

            "rules": [{

                "condition": {

                    "condition_type": "TRACING_THRESHOLD_CONDITION_TYPE_MORE_THAN_OR_UNSPECIFIED",

                    "span_amount": 20,

                    "time_window": {"tracing_time_window_value": "TRACING_TIME_WINDOW_VALUE_HOUR_1"}

                }

            }],

            "tracing_filter": {

                "simple_filter": {

                    "latency_threshold_ms": 3000,

                    "tracing_label_filters": {

                        "application_name": [{

                            "operation": "TRACING_FILTER_OPERATION_TYPE_INCLUDES",

                            "values": ["test"]

                        }]

                    }

                }

            }

        }

    }

}

EOF
```

### Response[​](#response-11 "Direct link to Response")

```
{

  "alertDef": {

    "alertDefProperties": {

      "name": "tracing threshold alert",

      "description": "Example of tracing threshold alert",

      "enabled": true,

      "priority": "ALERT_DEF_PRIORITY_P4",

      "type": "ALERT_DEF_TYPE_TRACING_THRESHOLD",

      "incidentsSettings": {

        "notifyOn": "NOTIFY_ON_TRIGGERED_AND_RESOLVED",

        "minutes": 10

      },

      "notificationGroup": {



      },

      "entityLabels": {

        "key1": "value1"

      },

      "phantomMode": false,

      "deleted": false,

      "tracingThreshold": {

        "tracingFilter": {

          "simpleFilter": {

            "tracingLabelFilters": {

              "applicationName": [

                {

                  "values": [

                    "test"

                  ],

                  "operation": "TRACING_FILTER_OPERATION_TYPE_INCLUDES"

                }

              ]

            },

            "latencyThresholdMs": 3000

          }

        },

        "rules": [

          {

            "condition": {

              "spanAmount": 20,

              "timeWindow": {

                "tracingTimeWindowValue": "TRACING_TIME_WINDOW_VALUE_HOUR_1"

              }

            }

          }

        ]

      }

    },

    "id": "321b4997-e07d-4132-8da2-82e320f03ad6",

    "createdTime": "2024-11-06T09:09:23Z",

    "updatedTime": "2024-11-06T09:09:23Z",

    "alertVersionId": "321b4997-e07d-4132-8da2-82e320f03ad6"

  }

}
```

## Create a flow alert[​](#create-a-flow-alert "Direct link to Create a flow alert")

Create a [Flow Alert](https://docs-docusaurus.kinsta.page/user-guides/alerting/create-an-alert/flow-alerts/.md).

### Request[​](#request-13 "Direct link to Request")

```
  grpcurl -H "Authorization: Bearer API_KEY_HERE" -d @ api.eu2.coralogix.com:443 com.coralogixapis.alerts.v3.AlertDefsService/CreateAlertDef <<EOF
```

```
{

    "alert_def_properties": {

        "name": "flow alert",

        "description": "Example of flow alert",

        "enabled":  true,

        "priority": "ALERT_DEF_PRIORITY_P4",

        "type": "ALERT_DEF_TYPE_FLOW",

        "incidents_settings": {

            "notify_on": "NOTIFY_ON_TRIGGERED_AND_RESOLVED",

            "minutes": 10

        },

        "flow": {

            "stages": [

                {

                    "timeframe_ms": "3000",

                    "timeframe_type": "TIMEFRAME_TYPE_UP_TO",

                    "flow_stages_groups": {

                        "groups": [

                            {

                                "alert_defs": [

                                    {

                                        "id":  "id_of_alert"

                                    }

                                ],

                                "alerts_op": "ALERTS_OP_OR",

                                "next_op": "NEXT_OP_AND_OR_UNSPECIFIED"

                            }

                        ]

                    }

                }

            ]

        }

    }

}

EOF
```

### Response[​](#response-12 "Direct link to Response")

```
{

  "alertDef": {

    "alertDefProperties": {

      "name": "flow alert",

      "description": "Example of flow alert",

      "enabled": true,

      "priority": "ALERT_DEF_PRIORITY_P4",

      "type": "ALERT_DEF_TYPE_FLOW",

      "incidentsSettings": {

        "notifyOn": "NOTIFY_ON_TRIGGERED_AND_RESOLVED",

        "minutes": 10

      },

      "notificationGroup": {



      },

      "phantomMode": false,

      "deleted": false,

      "flow": {

        "stages": [

          {

            "timeframeMs": "3000",

            "timeframeType": "TIMEFRAME_TYPE_UP_TO",

            "flowStagesGroups": {

              "groups": [

                {

                  "alertDefs": [

                    {

                      "id": "id_of_alert",

                      "not": false

                    }

                  ],

                  "alertsOp": "ALERTS_OP_OR"

                }

              ]

            }

          }

        ],

        "enforceSuppression": false

      }

    },

    "id": "b2e54052-7614-4354-83ca-9b33f6b3e208",

    "createdTime": "2024-11-06T09:10:33Z",

    "updatedTime": "2024-11-06T09:10:33Z",

    "alertVersionId": "b2e54052-7614-4354-83ca-9b33f6b3e208"

  }

}
```

## List alerts[​](#list-alerts "Direct link to List alerts")

This method does not require any arguments. Provide an empty request body.

```
grpcurl -H "Authorization: Bearer API_KEY_HERE" -d '' api.eu2.coralogix.com:443 com.coralogixapis.alerts.v3.AlertDefsService/ListAlertDefs
```

## Additional resources[​](#additional-resources "Direct link to Additional resources")

|                     |                                                                                                 |
| ------------------- | ----------------------------------------------------------------------------------------------- |
| Coralogix Endpoints | [Coralogix Endpoints](https://docs-docusaurus.kinsta.page/integrations/coralogix-endpoints/.md) |