Create alert conditions
When setting up a Coralogix alert condition, you may configure up to five condition rules, each with a threshold, timeframe, and individual priority. Priority values range from P1 through P5, with P1 being the highest priority and P5 being the lowest.
Condition rules determine the alert priority when the alert definition conditions are met and an alert is triggered. For instance, breaching a P1 threshold triggers a P1 alert, while breaching a lower-priority threshold triggers a corresponding alert (e.g., P2). If a threshold meets multiple priorities, the highest priority is applied.
Triggered alert conditions with their associated priority can be viewed in Incidents.
Multiple alert conditions are supported for the following alert types:
Set up an alert condition
Select a condition type
You can choose whether to be alerted when the conditions for an alert definition are more than or less than a specific threshold.
Define condition rules
Configure up to five condition rules for your alert definition.
Threshold alerts for metrics allow the user to set up a threshold when conditions are met for at least , at least once, or for over x% in a specific time period.
for at least: This option specifies that the condition should be met for the entire specified time period. For example, if you setfor at least 5 minutes, it means the metric must exceed the threshold continuously for the entire 5 minutes duration.at least once: This option is the most minimal condition. It means the alert will trigger if the threshold is crossed at least one time within the specified time period. For example,at least once in 5 minutesmeans that if the metric exceeds the threshold even once within that 5-minute window, the alert will be triggered.for over x%: This option allows you to set a duration percentage rather than a number of times. It specifies that the condition must hold true for more than a certain percentage of the time within the selected time window. For example, if you setfor over 10% of 10 minutes, the metric must exceed the threshold for more than 1 minute (10% of 10 minutes) in that time period for the alert to trigger. If the percentage is set to 0 and the query crosses the threshold once, an alert is triggered. If the percentage is set to 100, this means all of the time window values should cross the threshold.
Limitations
When defining multiple condition rules for an alert, all conditions must use timeframes from the same group. For instance, if one condition has a timeframe of 1H, all other conditions for the alert must adhere to the time windows specified for Group 2.
| Group | Timeframe |
|---|---|
| 1 | 1M - 30M |
| 2 | 1H - 6H |
| 3 | 12H - 36H |
Related resources
Next steps
Create metric alerts directly from numeric log fields with Log2Metric alert.