All Products
Search

This Product

    Simple Log Service:Fields in alert rule evaluation logs

    Document Center

    Simple Log Service:Fields in alert rule evaluation logs

    Last Updated:Aug 03, 2023

    After you create an alert rule in a project, Simple Log Service creates a Logstore. The Logstore stores the evaluation logs of the alert rules in the project. This topic describes the fields in alert rule evaluation logs.

    Fields in the log of an alert rule evaluation

    Field

    Description

    Example

    AlertDisplayName

    The display name of the alert rule.

    Test alert rule

    AlertID

    The unique ID of the alert rule execution.

    0fdd****eb23

    AlertName

    The name of the alert rule. The name is unique within a project.

    alert-1****5-153472

    AlertStatus

    The status of the alert. Valid values:

    • inactive: The alert is not triggered.

    • firing: The alert is triggered.

    • error: An execution error occurred.

    • paused: The alert rule is temporarily disabled.

    • pending: The threshold of continuous triggers is not reached.

    Note

    This field is included only in the evaluation logs of an alert rule of the new version.

    inactive

    Condition

    The conditional expression.

    $0.count > 1

    Dashboard

    The dashboard with which the alert rule is associated.

    my-dashboard

    FireCount

    • Alert rule of the old version: the accumulative number of triggers since the last alert notification.

    • Alert rule of the new version: the accumulative number of triggers before the threshold of continuous triggers is reached.

    1

    Fired

    Indicates whether an alert was triggered. Valid values: true and false.

    true

    LastNotifiedAt

    The time when the last alert notification was sent. The value is a UNIX timestamp.

    Note

    This field is included only in the evaluation logs of an alert rule of the old version.

    1642164541

    NotifyStatus

    The notification status of the alert. Valid values:

    • Success: indicates that alert notifications were sent.

    • Failed: indicates that alert notifications failed to be sent.

    • NotNotified: indicates that no alert notification was sent.

    • PartialSuccess: indicates that some of the alert notifications were sent.

    Important

    If the alert rule is of the new version, this field indicates whether evaluation results are sent to the alert management system. This field does not indicate whether alert notifications are sent.

    Success

    Reason

    The reason why alert notifications failed to be sent or no notification was sent.

    result type is not bool

    Results

    The parameters and results of a query. The value is of the array type. For more information, see Subfields in the Results field. 

    [
  {
    "EndTime": 1642334900,
    "FireResult": null,
    "LogStore": "test-logstore",
    "Query": "* | select count(1) as count",
    "RawResultCount": 1,
    "RawResults": [
      {
        "__time__": "1642334840",
        "count": "0"
      }
    ],
    "StartTime": 1642334840
  }
]

    Status

    The status of the alert rule evaluation. Valid values: Success and Failed.

    Success

    Subfields in the Results field

    Subfield

    Description

    Example

    Query

    The query statement.

    * | select count(1) as count

    Project

    The project from which data is queried.

    Note

    This field is included only in the evaluation logs of an alert rule of the new version.

    my-project

    LogStore

    The Logstore from which data is queried.

    Note

    This field is included only in the evaluation logs of an alert rule of the old version.

    my-logstore

    Store

    The Logstore from which logs are queried.

    Note

    This field is included only in the evaluation logs of an alert rule of the new version.

    my-logstore

    Region

    The region where the queried data resides.

    Note

    This field is included only in the evaluation logs of an alert rule of the new version.

    cn-hangzhou

    StoreType

    The type of the destination store from which data is queried. Valid values: log and metric.

    Note

    This field is included only in the evaluation logs of an alert rule of the new version.

    log

    StartTime

    The start time of the query time range. The value is a UNIX timestamp.

    1685607401

    EndTime

    The end time of the query time range. The value is a UNIX timestamp.

    Important

    The query time range is [StartTime, EndTime). It means that the query time range includes the start time and excludes the end time.

    1685608001

    RawResults

    The raw query result that is formatted in an array. Each element in the array is a log.

    The length of the array varies based on the size of the log content. The array can contain up to 100 logs or can be 2 KB in length. 

    [
  {
    "__time__": "1642334840",
    "count": "0"
  }
]

    RawResultCount

    The number of raw logs that are returned.

    1

    FireResult

    The log that records the triggers of an alert. If no alert is triggered, the parameter value is null. 

    {
  "__time__": "1642334840",
  "count": "0"
}

    Truncated

    Indicates whether the raw query result is truncated. Valid values: true and false.

    Note

    This field is included only in the evaluation logs of an alert rule of the new version.

    false