Skip to content
This is an archived version of the documentation downloaded from LogScale Documentation Archives. Up to date documentation, and documentation for later versions, is available on LogScale Documentation

### Creating Alerts

##### Security Requirements and Controls

- `Change triggers and actions` permission

Alerts are constructed using queries and associated with one or more actions that will be triggered when the query runs. When typing a query to create an alert, the type of alert is automatically selected for you. This will adjust which configuration operations are available. They are summarized in the table below.

Configuration | Aggregate Alert | Filter Alert | Legacy Alert
--- | --- | --- | ---
General Parameters | Configurable in the General section of the Alert Properties. | Creating an Alert, General section | Creating an Alert, General section
Query | Yes, using aggregates except `bucket()`, `timeChart()` `start()`, `end()`, `now()`, and Join Query Functions | Yes, aggregates and joins are not supported | Yes, using aggregates except `bucket()` and Join Query Functions
Actions | Yes, see Actions | Yes, see Actions | Yes, see Actions
Throttling | Yes, seeSetting Alert Throttle Period | Yes, seeSetting Alert Throttle Period | Yes, seeSetting Alert Throttle Period
Action Retries | Yes, for a single action; when multiple actions are configured, no retry is performed if at least one action is successfully invoked. | Yes, for a single action; when multiple actions are configured, no retry is performed if at least one action is successfully invoked. | Yes, for a single action; when multiple actions are configured, no retry is performed if at least one action is successfully invoked.

#### Creating an Alert from the Alerts Overview

1. Go to the Automation tab on the top bar of the User Interface and select Alerts from the menu on the left, the full list of available alerts appears in the `Alerts` overview page:

   Figure 125. Alerts Overview

   The table lists the currently configured alerts for the selected repository or view, with information such as the alert name, type, the status of the action attached to the alert, etc. Use this page for filtering and managing alerts.

2. Click + New alert on the top right and the `Search` page is displayed in Creating new alert mode — it is streamlined to only include the relevant Time Selector and Run buttons.

   Figure 126. Simplified Search page

3. Type a query for your alert and click Run

4. Fill in the Details side panel on the right, as depicted in Figure 128, “New Alert Details”.

5. Click the Save button on top: the new alert is now displayed in the alerts overview, see Figure 125, “Alerts Overview”.

#### Creating an Alert from a Query

A query that's just been typed in `Search` can be converted to a new alert:

1. Go to the Search tab on the top bar of the User Interface.

2. Type the query you need for your alert and click Run.

3. Click Save near the top-right and choose the Alert option. The Save menu is disabled if the query is invalid for the alert you're trying to save.

   Figure 127. Save a Query as Alert

4. Fill in the Details side panel as required:

   Figure 128. New Alert Details

   For the full list of alert properties that can be set from the side panel, see Alert Properties.

   Pay special attention in selecting the right Alert type: a recommended alert type is suggested based on the query. For example, if the query contains an aggregate function, you can see that the Aggregate type is selected in the side panel. Options are:

   - Filter for filtering functions

   - Aggregate for aggregate queries without explicit bucketing

   - Legacy for the few queries that cannot be used with the other two types, or for pre-existing alert queries. For information on the different alert types, see Alerts.

   ### Note

   If the recommended alert type is ignored and another type is selected, the query editor will show a notification that the query is forbidden for that alert type.

5. Click Save alert to complete the alert creation: the new alert is now displayed in the alerts' overview, see Figure 125, “Alerts Overview”.

#### Enter search term