Available: The humio-trigger-execution-info Repository v1.217.0

The humio-trigger-execution-info Repository is available from version 1.217.0.

The humio-trigger-execution-info repository contains execution information from scheduled searches.

Important

Data in system repositories cannot be redacted. For more information about immutability of data, see Immutability of data.

This repository can then be used to:

  • Show historic status information

  • Configure alerting, for example, when triggers or actions fail

  • Calculate metrics

The standard metadata fields are available in the repository. (Note that the @rawstring metadata field is left intentionally blank.) The table below contains some of the more useful fields an event could have:

Field Example Value Explanation For event type(s)
orgId ย  The organization ID that the measurements in this log line pertain to. All events
viewId wlZkMJVjO5CSWhjCoyhI6Dok View ID where the event occurred. All events
dataspace humio Dataspace where the event occurred. All events
triggerId 4upGf6Vmn0QH2YlUzbIFdjNeTI01Z5Qo Trigger ID for the event. All events
triggerType ScheduledSearch Type of trigger for the event. Currently, only scheduled search is supported. All events
event RunFailed Event that occurred. Can be:

  • RunScheduled

  • ExecutionStarted

  • RunSucceeded

  • ExecutionSucceeded

  • ExecutionFailed

  • RunAborted

  • ActionSucceeded

  • ActionFailed

  • ActionMissing

All events
plannedExecutionTime 1761893220000 Time the event was planned to occur. This timestamp is in milliseconds since the epoch (1st Jan 1970, 00:00) of the event. All events
triggered true Boolean flag that indicates if the trigger was triggered; only appears on RunSucceeded events. RunSucceded
error All actions associated with the scheduled search failed. The scheduled search will retry invoking the actions. If the run resulted in an error, the error message appears. Errors will only appear on ExecutionFailed events. ExecutionFailed
warnings[0], warnings[1], and so on Triggered warning Warnings are an array field. If the run resulted in warnings, Triggered warning appears.

RunSucceeded

ExecutionFailed

actionId opZ5KnOyo6RDtreqhVk0nrEMgeCchxLJ Action ID associated with the event

ActionSucceeded

ActionFailed

ActionMissing

actionType LogScaleRepository Type of action triggered. For information about action types, see Actions.

ActionSucceeded

ActionFailed

retryable true When a scheduled search execution fails, this field indicates whether the failure is retryable (such as, transient errors such as timeouts, I/O errors, or HTTP 5xx responses) or non-retryable (permanent errors such as invalid configuration, missing actions, or blocked queries). True indicates that the scheduled search is retryable. ExecutionFailed events for scheduled searches
eventFileVersionId 4fSt8OKl1rqOGUhaeW1hwWLVllTDfQd7 Version ID returned by S3 for the event file from S3 actions. ActionSucceeded events where actionType is S3.
metadataFileVersionId 9NLJbTWleCi_p1LeT3zRpz5g8BttjGVv Version ID returned by S3 for the metadata file from S3 actions. ActionSucceeded events where actionType is S3.

Examples

The following examples show the order of log message you will see in different scenarios.

A run that is already too old when the previous one is done:

RunAborted

A run that is scheduled to run, but never gets to run before it is too old:

RunScheduled โ†’ RunAborted

A run that succeeds on first execution without triggering:

RunScheduled โ†’ ExecutionStarted โ†’ ExecutionSucceeded โ†’ RunSucceeded

A run that succeeds on first execution and triggers:

RunScheduled โ†’ ExecutionStarted โ†’ ActionSucceeded โ†’ ExecutionSucceeded โ†’ RunSucceeded

A run that succeeds on first execution, one action fails, another succeeds and a third one is missing:

RunScheduled โ†’ ExecutionStarted โ†’ ActionFailed โ†’ ActionSucceeded โ†’ ActionMissing โ†’ ExecutionSucceeded โ†’ RunSucceeded

A run that fails on first execution, and is then aborted:

RunScheduled โ†’ ExecutionStarted โ†’ ActionFailed โ†’ ExecutionFailed โ†’ RunAborted

A run that fails on first execution, then succeeds:

RunScheduled โ†’ ExecutionStarted โ†’ ActionFailed โ†’ ExecutionFailed โ†’ ExecutionStarted โ†’ ActionSucceeded โ†’ ExecutionSucceeded โ†’ RunSucceeded