Skip to content
This is an archived version of the documentation downloaded from LogScale Documentation Archives. Up to date documentation, and documentation for later versions, is available on LogScale Documentation

###### Filter alert errors and solutions

The following table contains errors and resolutions for filter alerts.

Table: Filter alert errors and solutions

Message | Version | Severity | Status | Description | Solution
--- | --- | --- | --- | --- | ---
Problem invoking action. If all actions fail, they will be retried |  | `Error` | `` | There was a problem invoking the alert's actions and all actions failed. In order to be successful, at least one action must trigger on an alert. The alert is not considered to have triggered and will not be throttled. | Check the logs for the invoked actions if unsure which action failed. Check if there are any problems with the action targets, such as e-mail server down, pager service down, and so on.
Polling alert query resulted in an error |  | `Error` | `` | The alert query produced an error. This can be due to many different reasons. | Look at the message in the `exceptionMessage` and consult documentation based upon that for possible solutions.
Starting alert query resulted in an error |  | `Error` | `` | The query returned an error when starting. This is usually because of an error in the query. | Look at the message in the `exceptionMessage` field and consult documentation based upon that for possible solutions. Contact LogScale Support for assistance if needed.
An event from the alert query does not contain @id or @ingesttimestamp |  | `Error` | `` | The alert query has removed the @id or @ingesttimestamp fields. This is needed for the alert to be able to run. | Check the alert query definition and edit it so that it preserves @id and @ingesttimestamp , if needed. For more information about how to do this, see Editing an Alert.
Triggering on event did not succeed within retry limit, it will not be retried further |  | `Error` | `` | There was an action error and the value in the configurable `FILTER_ALERTS_MAX_CATCH_UP_LIMIT` parameter has been reached. It will not attempt to trigger the action further. | Check the specific errors or warnings from invoking actions. If needed, contact LogScale Support for assistance.
Could not start alert query since it is blocked |  | `Error` | `` | The alert query cannot run since it is blocked. | Either rewrite the alert query so it is no longer blocked, or check with the system administrator and remove the query from the blocklist. If using LogScale Cloud, this error can occur if the cluster is in a maintenance window.
Did not start historic query to catch up since ingest is too far behind |  | `Error` | `` | Data is behind because ingest has not caught up. So the historic query on older data cannot run. | Look at other logs from the alert to see if there are any errors or warnings, or check whether there are other problems with LogScale.
Alert is too far behind. Will skip events that are older than the catch up limit |  | `Error` | `` | Data older than X hours based on the configured value in the `FILTER_ALERTS_MAX_CATCH_UP_LIMIT` parameter will not be considered in alert results. | Look at other logs from the alert to see if there are any errors or warnings, or check whether there are other problems with LogScale.
There has been a query warning that some events are unavailable for more than ${limit}. These events will now be skipped |  | `Error` | `` | Some events have been unavailable for more that the configured amount of time for the cluster. If there were events that may have produced results, these events were skipped during query execution. | Look at the query warning. Run query manually, if needed. Check cluster performance.
The alert is broken |  | `Error` | `` | The alert configuration prevents the alert from running. | Edit the alert, check all fields and queries, and save it again. For more information about how to do this, see Editing an Alert.
The alert is not assigned to run on any node |  | `Error` | `` | The alert is not assigned to run on any nodes. Alerts are distributed evenly among the nodes in a cluster, so that each one runs on a single node. Reassignment of nodes on which alerts run occurs automatically when new cluster nodes are added or old cluster nodes are removed. | If the alert does not run on another node after 15 minutes, contact LogScale Support.
Cannot run ${triggerType.toLowerCase}. ${triggerType} was saved by a user that does not exist anymore. Change the alert to run as a different user or on behalf of the organization. |  | `Error` | `` | The user attempting to execute the query no longer exists in the system. | Save the alert as a user that exists in the system, or change the alert to run on behalf of the organization. For more information about how to do this, see Editing an Alert.
Cannot run ${triggerType.toLowerCase}. ${triggerType} was saved by a user that does not exist anymore. Change the ${triggerType.toLowerCase} to run as a different user or on behalf of the organization. | 1.166.0 | `Error` | `` | The user attempting to execute the query no longer exists in the system. | Save the alert as a user that exists in the system, or change the alert to run on behalf of the organization. For more information about how to do this, see Editing an Alert.
Cannot run ${triggerType.toLowerCase}. ${triggerType} was saved by a user that no longer has read permission on the view. Grant the user permission again, or change the alert to run as a different user or on behalf of the organization. |  | `Error` | `` | The configured user no longer has read access to the view or repository. | grant the user read permissions on the repository or view that the alert is running in, or save the alert with a user that has such permissions or to run on behalf of an organization.
Cannot run ${triggerType.toLowerCase}. ${triggerType} was saved by a user that no longer has read permission on the view. Grant the user permission again, or change the ${triggerType.toLowerCase} to run as a different user or on behalf of the organization. | 1.166.0 | `Error` | `` | The configured user no longer has read access to the view or repository. | grant the user read permissions on the repository or view that the alert is running in, or save the alert with a user that has such permissions or to run on behalf of an organization.
Alert has changed, restarting query |  | `Info` | `` | The alert query was edited while running, so the query will restart automatically. | None. This message is informational.
Alert found results, but no actions were invoked since the alert is throttled |  | `Info` | `` | The alert found results, but no actions were invoked since the alert is throttled. | None. This message is informational.
Alert found no results and will not trigger |  | `Info` | `` | The alert query, as configured, found no events that matched its requirements and no actions will trigger. | None. This message is informational.
Alert query polled |  | `Info` | `` | The alert query ran. | None. This message is informational.
Query started |  | `Info` | `` | The query started successfully. | None. This message is informational.
The alert was deleted |  | `Info` | `` | The alert was deleted and will not run. | It is not possible to recover a deleted alert. If you want it to run, you must create the alert again.
The organization of the alert was deleted |  | `Info` | `` | The organization for which the alert was created has been deleted. | Recreate the alert for another organization.
The view of the alert was deleted |  | `Info` | `` | The view with which the alert was associated has been deleted and the job cannot run. | Add the alert to another view.
The alert was disabled |  | `Info` | `` | The alert was disabled by a user and cannot run. | If you want the alert to run, enable it again. For more information about how to do this, see Editing an Alert.
License has expired |  | `Info` | `` | The license has expired and must be renewed to continue. | Contact LogScale Support for assistance.
The alert has no associated actions |  | `Info` | `` | The alert has no associated actions. Because a successful alert must trigger at least one action, the alert is stopped. | Edit the alert to add actions and save it. For more information about how to do this, see Editing an Alert.
The organization is being transferred |  | `Info` | `` | The organization is being transferred to a new cluster, and alerts are stopped during the transfer process. | If not resolved after 15 minutes, contact Logscale Support for more information.
The alert was assigned to run on node $vhost |  | `Info` | `` | The alert was assigned to run on a another node in the cluster. | None. This message is informational.
The view is not connected to any repository |  | `Info` | `` | The alert contains a view that is not connected to any repository. | Edit the view to connect it to a repository, or edit the alert to use another view that is connected to a repository.
Alert triggering on event |  | `Info` | `` | The alert is triggering actions. | None. This message is informational.
Alert triggered on event and invoked at least one action |  | `Info` | `` | The alert triggered and invoked at least one action and will be throttled. This indicates a successful alert. | None. This message is informational.
Starting alert query in previous run has not finished. The alert will not be polled in this run |  | `Warning` | `` | The alert query starting did not finish in the previous run, so it cannot be polled in the current run. | None. This message is informational. If the problem continues, you can disable the alert, wait one minute, and enable the alert. NOTE: If you do this you may lose results.
Starting the alert query has not finished. The alert will not be polled in this run |  | `Warning` | `Failure` | Query is submitted but has not finished initial loading. | None. This message is informational.
Discarding values for field-based throttling. The alert might trigger again before the throttle period expires |  | `Warning` | `` | Maximum amount of field values for throttling has been reached. Once exceeded, the older values are discarded and can produce alerts again even though they are within the throttling period. The values for field-based throttling are set in the following field based on the alert type: `ALERT_MAX_THROTTLE_FIELD_VALUES_STORED`. For more information about field-based throttling, see Field-Based Throttling. | If possible, use a field that produces a smaller amount of different values.
Unknown action |  | `Warning` | `` | The alert contains an unknown action. | Edit the alert, remove the action, and add a different action.
Polling encountered a cancelled query |  | `Warning` | `` | The query was cancelled before execution could complete. | The cancelled query will be restarted automatically. If the problem persists, contact the system administrator.
Polling alert query in previous run has not finished. The alert will not be polled in this run |  | `Warning` | `` | The alert query did not finish in the previous run, so it cannot be polled in the current run. | None. This message is informational. If the problem continues, you can disable the alert, wait one minute, and enable the alert. NOTE: If you do this you may lose results.
Query uses functionality scheduled to change in an automation breaking way |  | `Warning` | `` | The query contains some functionality that may break the alert after a coming release. | Look at the warning in the warning field, check the release notes for guidance about what has changed and how to adjust, and edit the query accordingly.
$message The alert will trigger with the old information from the database |  | `Warning` | `` | The database shown in the errorMessage has not been updated recently. | Contact the system administrator to update the database.
Query uses deprecated functionality |  | `Warning` | `` | The query contains some functionality that has been deprecated in a release. | Look at the warning in the warning field, check the release notes for guidance about what has changed and how to adjust, and edit the query accordingly.
Some events are delayed in ingest. The alert will trigger for available events |  | `Warning` | `` | Some events are still in the ingest phase and cannot be queried. The alert will trigger for all available events. | None. This message is informational. If the message continues, contact the system administrator.
Some events are currently not available. The alert will trigger for available events |  | `Warning` | `` | It is not possible to collect results for some events because the events were not available when the query ran. The alert will trigger for all other available events. | If the problem continues, contact Logscale Support.
$message The alert will trigger without information from the database |  | `Warning` | `` | The database shown in the errorMessage does not exist or is not available. | Contact the system administrator for assistance.
Query output cleaned for security reasons. $message The alert will trigger for available events |  | `Warning` | `` | The query results contains specific characters that could be misused. These have been removed. | None. This message is informational. For self-hosted solutions, it is possible to turn off this functionality.
Problem with file used in `match`. $message The alert will trigger for available events |  | `Warning` | `` | Error in CIDR data in CSV file that will be skipped when parsing the data in the alert query. | Check the CSV file and fix the column containing CIDR data.
$message The alert will trigger for available events |  | `Warning` | `` | Not enough resources to run query. | Contact the system administrator for assistance.
Alert is behind. Will stop live query and start running historic queries to catch up |  | `Warning` | `` | The alert execution is behind. The system will stop live queries and start running historic queries to catch up. | None. This message is informational. If the `isLiveQuery` field never reverts to true, contact the system administrator.
Filter alert received too many events. It will only trigger on ${state.triggerLimit} per ${FilterAlertJobImpl.QueryBucketDuration} | 1.167.0 | `Warning` | `` | The alert resulted in too many events and cannot trigger all events. The query is likely too broad. | If this was unexpected, rewrite the alert query to produce fewer results. For more information about how to do this, see Editing an Alert.
Filter alert received too many events. It will only trigger on ${state.triggerLimit} per ${FilterAlertJobImpl.QueryBucketSpan} |  | `Warning` | `` | The alert resulted in too many events and cannot trigger all events. The query is likely too broad. | If this was unexpected, rewrite the alert query to produce fewer results. For more information about how to do this, see Editing an Alert.
Filter alert did not trigger. Trigger limit of ${state.triggerLimit} per ${FilterAlertJobImpl.QueryBucketDuration} has already been reached | 1.167.0 | `Warning` | `` | The alert resulted in too many events and cannot trigger all events. The query is likely too broad. | If this was unexpected, rewrite the alert query to produce fewer results. For more information about how to do this, see Editing an Alert.
Filter alert did not trigger. Trigger limit of ${state.triggerLimit} per ${FilterAlertJobImpl.QueryBucketSpan} has already been reached |  | `Warning` | `` | The alert resulted in too many events and cannot trigger all events. The query is likely too broad. | If this was unexpected, rewrite the alert query to produce fewer results. For more information about how to do this, see Editing an Alert.
Alert failed triggering on event |  | `Warning` | `` | There was a problem triggering the alert's actions. In order to be successful, at least one action must trigger on an alert. The alert is not considered to have triggered and will not be throttled. | Check the logs for the actions if unsure which action failed. Check if there are any problems with the action targets, such as e-mail server down, pager service down, and so on.
Unknown query warning. The alert will trigger for available events |  | `Warning` | `` | The alert encountered an unknown query. This occurs if, for example, if LogScale is being upgraded. The alert will trigger for the available events but not for any events that might be the result of the unknown query. | Look at the warning in the warning field for more information.

#### Enter search term