# Flow alerts

Copy as Markdown[Open in ChatGPT](https://chatgpt.com/?q=Read%20https%3A%2F%2Fdocs-docusaurus.kinsta.page%2Fuser-guides%2Falerting%2Fcreate-an-alert%2Fflow-alerts.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)[Open in Claude](https://claude.ai/new?q=Read%20https%3A%2F%2Fdocs-docusaurus.kinsta.page%2Fuser-guides%2Falerting%2Fcreate-an-alert%2Fflow-alerts.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)

Flow alerts notify you when a sequence of alert events occurs in a specific order within a defined time window. Use them to correlate signals across logs, metrics, traces, and security, so you alert on a chain of events rather than isolated symptoms, and surface a likely root cause.

For example, to catch an HTTP error spike caused by high CPU, configure a flow alert that fires when a high HTTP error rate alert follows a high CPU utilization alert within a set time frame.

## What you need[​](#what-you-need "Direct link to What you need")

* Access to Coralogix with permission to create alerts
* The individual alerts you want to chain, already created

## How a flow is structured[​](#how-a-flow-is-structured "Direct link to How a flow is structured")

You assemble a flow from two building blocks in the flow builder:

* **Group**: a logical combination of individual alerts, joined with the **OR**, **AND**, and **NOT** operators.
* **Stage**: one or more groups that must trigger within a specified time frame. A flow is an ordered series of stages.

[![Flow alert groups within a stage](/assets/images/Flow-Alert-Groups-and-Stages-057cac5488f449ac2f3f9d2d4cd11eab.webp)](https://docs-docusaurus.kinsta.page/assets/images/Flow-Alert-Groups-and-Stages-057cac5488f449ac2f3f9d2d4cd11eab.webp)

Shows how individual alerts combine into groups, and groups into a time-bound stage.

### Limitations[​](#limitations "Direct link to Limitations")

* The cumulative time frame across all stages cannot exceed 168 hours (1 week). A larger value resets to zero.

* A single flow alert can combine a maximum of 30 alerts.

* The following alert types do not support the **NOT** operator:

  <!-- -->

  * New value
  * Unique count
  * Immediate

## Build a flow alert[​](#build-a-flow-alert "Direct link to Build a flow alert")

To create a flow alert, go to **Alerts**, then select **Create alert**. The [alert creation wizard](https://docs-docusaurus.kinsta.page/user-guides/alerting/configuring-alert-definition/.md) opens on the Query step. The Flow type uses the same four-step flow as every alert (Query, then Condition, then Notification, then Details). Naming, labels, and scheduling now come last on the Details step, not first; the steps below cover the flow-specific work.

### Query and condition: build the sequence[​](#query-and-condition-build-the-sequence "Direct link to Query and condition: build the sequence")

1. On the Query step, select the **Flow** alert type, then select **Open Flow Builder**.
2. Drag existing alerts from the left panel into the builder workspace. Hover an alert to see its **Query**, **Conditions**, and **Group by** fields.
3. Organize the alerts into groups and stages, and set a time frame for each stage.
4. Select **Apply** to save the flow.
5. Select the **Group by** keys for the flow.

Note

The available **Group by** keys are the intersection of the keys across the alerts in the flow. If alert A is grouped by `Region` and `Cluster`, and alert B is grouped by `Region` and `Pod`, the flow can only group by `Region`. Hover an alert in the builder to see its available keys.

To keep a constituent alert from firing on its own, enable Phantom mode on that alert. Only the flow then triggers a notification and opens an incident, while its building-block alerts stay silent.

For the Notification and Details steps, including routing, cadence, alert scheduling, naming, and labels, see [Configuring an alert definition](https://docs-docusaurus.kinsta.page/user-guides/alerting/configuring-alert-definition/.md) and [Define alert details](https://docs-docusaurus.kinsta.page/user-guides/alerting/define-alert-details/.md).

## Example[​](#example "Direct link to Example")

The following flow notifies you when successful orders drop because of a failed database cleanup task that ran 24 hours earlier.

[![Flow alert correlating a failed cleanup task with a later drop in successful orders](/assets/images/image-12-1024x483-318ddecbc8def4a4b18e109c78e93b30.webp)](https://docs-docusaurus.kinsta.page/assets/images/image-12-1024x483-318ddecbc8def4a4b18e109c78e93b30.webp)

Shows a two-stage flow linking an earlier failure to a later business-metric drop.

## Related resources[​](#related-resources "Direct link to Related resources")

[Configuring an alert definition](https://docs-docusaurus.kinsta.page/user-guides/alerting/configuring-alert-definition/.md)[Introduction to alerts](https://docs-docusaurus.kinsta.page/user-guides/alerting/introduction-to-alerts/.md)[Notification Center](https://docs-docusaurus.kinsta.page/user-guides/notification-center/introduction/.md)

## Next steps[​](#next-steps "Direct link to Next steps")

Configure alert name, description, and labels in [Define alert details](https://docs-docusaurus.kinsta.page/user-guides/alerting/define-alert-details/.md).