The CreateAlert input includes various settings.

Table: CreateAlert

ParameterTypeRequiredDefaultDescription
Some arguments may be required, as indicated in the Required column. For some fields, this column indicates that a result will always be returned for this column.
Table last updated: Sep 17, 2024
actions[string]yes List of unique identifiers of actions to execute on query result.
descriptionstringyes Description of the alert.
enabledbooleanyes Flag indicating whether the alert is enabled.
labelsbooleanyes Labels attached to the alert.
namestringyes Name of the alert.
queryOwnershipTypeQueryOwnershipType  Ownership of the query run by this alert. If value is User, ownership will be based on the runAsUserId field. See QueryOwnershipType.
queryStartstringyes Start of the relative time interval for the query.
queryStringstringyes LogScale query to execute.
runAsUserIdstring  The alert will run with the permissions of the user corresponding to this ID if the queryOwnershipType field is set to User. If the queryOwnershipType is set to Organization, whilst runAsUserId is set, this will result in an error. If not specified, the alert will run with the permissions of the calling user. It requires the 'ChangeTriggersToRunAsOtherUsers' permission to set this field to a user id different from the calling user.
throttleFieldstringyes Field on which to throttle.
throttleTimeMillisstringyes Throttle time in milliseconds.
viewNamestringyes Name of the view of the alert.