UnsavedAggregateAlert is a datatype for an unsaved aggregate alert. It's used by the generateAggregateAlertFromTemplate() and generateAggregateAlertFromPackageTemplate() query fields.

Table: UnsavedAggregateAlert

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: Feb 10, 2026
actions[Action]yes Long-TermList of actions to fire on query result. See Action.
descriptionstring  Long-TermDescription of the aggregate alert.
enabledbooleanyes Long-TermFlag indicating whether the aggregate alert is enabled.
labels[string]yes Long-TermLabels attached to the aggregate alert.
namestringyes Long-TermName of the aggregate alert.
queryStringstringyes Long-TermThe LogScale query to execute.
queryTimestampTypeQueryTimestampTypeyes Long-TermTimestamp type to use for a query. See QueryTimestampType.
searchIntervalSecondslongyes Long-TermThe search interval in seconds.
throttleFieldstring  DeprecatedThe field on which to throttle. This can be set only if throttleTimeSeconds is set. Aggregate alerts now support multiple throttle fields. This field will be removed at the earliest in version 1.279. Use instead the throttleFields field.
throttleFields[string]  Long-TermThe fields on which to throttle. This can be set only if throttleTimeSeconds is set.
throttleTimeSecondslongyes Long-TermThe throttle time in seconds.
triggerModeTriggerModeyes Long-TermThe mode used for triggering the alert. See TriggerMode.