# New value alerts

Copy as Markdown[Open in ChatGPT](https://chatgpt.com/?q=Read%20https%3A%2F%2Fdocs-docusaurus.kinsta.page%2Fuser-guides%2Falerting%2Fcreate-an-alert%2Flogs%2Fnew-value-alerts.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)[Open in Claude](https://claude.ai/new?q=Read%20https%3A%2F%2Fdocs-docusaurus.kinsta.page%2Fuser-guides%2Falerting%2Fcreate-an-alert%2Flogs%2Fnew-value-alerts.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)

A new value alert fires when a value that has not been seen before appears in a log field within a time window. Coralogix builds the list of known values while the alert is active and tests each incoming log against it. Use it to detect first-time occurrences, for example a new domain connection in `security.highest_registered_domain` (a possible attack) or a new application `error_code` (a new issue).

## What you need[​](#what-you-need "Direct link to What you need")

* Access to Coralogix with permission to create alerts
* A log field whose new values you want to track

## Define the new value alert[​](#define-the-new-value-alert "Direct link to Define the new value alert")

To start, go to **Alerts**, then select **Create alert**. The alert creation wizard opens on the Query step. This page covers the parts of the wizard specific to new value alerts. For the shared steps, see the [alert creation wizard](https://docs-docusaurus.kinsta.page/user-guides/alerting/configuring-alert-definition/.md).

### Query step[​](#query-step "Direct link to Query step")

1. Select the **New value** alert type.
2. Optionally write a DataPrime or Lucene query and adjust the application, subsystem, and severity filters to limit the logs the alert evaluates. Without a query, the alert evaluates all logs.

### Condition step[​](#condition-step "Direct link to Condition step")

Set what the alert watches and how long it remembers values:

* **Key to track**: the log field to monitor for new values, for example a country name or an error code.
* **Notify on new value in the last**: the window over which a value counts as known. A value that has not appeared within this window triggers the alert when it next arrives. You can track a key for up to 3 months.

The alert fires the first time a value appears that is not already in the tracked list for the selected window.

Set routing and naming in the [alert creation wizard](https://docs-docusaurus.kinsta.page/user-guides/alerting/configuring-alert-definition/.md) Notification and Details steps, then select **Create alert**. The alert becomes active within 15 minutes.

Alert behavior details

* A new or updated alert becomes active after the configured time window or 7 days, whichever is shorter. This lets Coralogix train on the set of values, capture a baseline, and reduce false notifications.
* The alert tracks up to 50K unique values in the time window. When the list reaches 50K, the alert does not trigger until values are cleared. A value is cleared when its age equals the alert time window, and its first detection after clearing triggers the alert again.
* The first 255 characters are used as the value. Two values that share the same first 255 characters are treated as the same value.
* After the alert triggers, a 5-minute silence period applies. During this time new values are added to the list but do not trigger the alert.

## Related resources[​](#related-resources "Direct link to Related resources")

[Configure alert definition](https://docs-docusaurus.kinsta.page/user-guides/alerting/configuring-alert-definition/.md)[Notification Center](https://docs-docusaurus.kinsta.page/user-guides/notification-center/introduction/.md)[Cases](https://docs-docusaurus.kinsta.page/user-guides/cases/overview/.md)[Incidents](https://docs-docusaurus.kinsta.page/user-guides/alerting/incidents/.md)

## Next steps[​](#next-steps "Direct link to Next steps")

Compare two log queries and alert on their ratio with [Ratio alerts](https://docs-docusaurus.kinsta.page/user-guides/alerting/create-an-alert/logs/ratio-alerts/.md).