Log-based monitoring alarm use cases can be implemented by configuring alarm policies. This document describes how to configure an alarm policy in the CLS console.
|Log topic||Target log topic for which monitoring alarms are to be configured||Log topic `nginx`|
|Analysis statement||Analysis statement that acts on the log topic||Example 1. Get the number of logs in the `error` state
status:error ｜ select count(*) as ErrCount
Example 2. Get the average request latency of the domain name (url:aaa.com)
url:"aaa.com" | select avg(request_time) as Latency
|Query time range||Data time range where the analysis statement is to be run each time||Example 1. Get the number of logs in the error status in the last 5 minutes
Example 2. Get the average latency of the requests made in the last 1 minute
|Period Configuration Method||Description||Example|
|Fixed frequency||Monitoring tasks are performed at fixed intervals
Interval: 1-1440 minutes; granularity: minute
|Monitoring tasks are performed once every 5 minutes|
|Fixed time||Monitoring tasks are performed once at fixed points in time
Time point range: 00:00-23:59; granularity: minute
|Monitoring tasks are performed once at 02:00 every day|
$Nindicates the Nth monitoring object in the current alarm policy (for more information, please see How do I view the number of a monitoring object?).
keynameindicates the name of the corresponding field. For example,
$1.status>500indicates triggering the alarm for the 1st monitoring object if the
statusfield carries a value greater than 500. For more expression syntax, please see Trigger Condition Expression Syntax.
After the alarm policy is configured, click Test Monitoring Task to verify the analysis statement and trigger condition syntax.
If the syntax is correct, results similar to the following are displayed:
Notification channel group
The notification channels and objects can be set by associating a notification channel group. Notifications can be sent by SMS, email, phone call, WeChat, WeCom, and custom callback API (webhook). For more information, please see Managing Notification Groups.
By adding preset variables to notification content, you can easily understand alarm content. For the variable list and descriptions, see Notification Content Variables.
Custom API callback configuration
If the selected notification channel group contains a custom callback API, an input box for the custom API callback configuration is displayed. For the variable list and descriptions, see Custom API Callback Variables. There are some duplicate parts between these custom API callback variables and notification content variables, but they are not exactly the same. The variables listed in the document shall prevail when used.
You can click Add Item to add the multi-dimensional analysis content of
Top 5 field values by occurrence and their percentages or
Custom search and analysis statement to alarm notifications. Currently, a single alarm supports up to 3 multi-dimensional analysis configurations.
Multi-dimensional analysis applies only to the logs within the query time range specified in the alarm query statement. If an alarm policy contains multiple query statements, the largest query time range prevails. For example, if the alarm policy in the following figure is triggered, multi-dimensional analysis applies only to the query time range Last 15 Minutes specified in the second query statement.
If you select
Top 5 field values by occurrence and their percentages, you need to select an analysis field (only a field with indexing enabled under the current log topic can be selected).
Multi-dimensional analysis displays the top 5 content occurrences under the target field in all logs within the query time range.
If you need more flexible content configuration, select
Custom search and analysis statement, and enter an analysis statement in the same format as that of an alarm analysis statement.
The following figure shows the final display effect of the notification on a web page.
After the configuration is completed, click Preview to preview the display effect of all channels.
The number of a monitoring object is displayed on its left. The query number for the 1st object is 1, the query number for the 2nd object is 2, and so on.