Available: The humio-trigger-execution-info Repository v1.217.0

The humio-trigger-execution-info Repository is available from version 1.217.0.

The humio-trigger-execution-info repository contains execution information from:

  • Scheduled searches

  • Filter alerts from version 1.253

Important

Data in system repositories cannot be redacted. For more information about immutability of data, see Immutability of data.

This repository can then be used to:

  • Show historic status information

  • Configure alerting, for example, when triggers or actions fail

  • Calculate metrics

Event fields metadata available

The standard metadata fields are available in the repository. (Note that the @rawstring metadata field is left intentionally blank.) The table below contains some of the more useful fields an event could have:

Field Example Value Explanation Scheduled search events Filter alert events
orgId ย  The organization ID that the measurements in this log line pertain to. All events All events
viewId wlZkMJVjO5CSWhjCoyhI6Dok View ID where the event occurred. All events All events
dataspace humio Dataspace where the event occurred. All events All events
triggerId 4upGf6Vmn0QH2YlUzbIFdjNeTI01Z5Qo Trigger ID for the event. All events All events
triggerType ScheduledSearch Type of trigger for the event. All events All events
event RunFailed

Event that occurred.

All of the following events:
Event Description
RunScheduled Scheduled search run scheduled
ExecutionStarted Scheduled search execution started
RunSucceeded Scheduled search run succeeds
ExecutionSucceeded Scheduled search execution succeeds
ExecutionFailed Scheduled search execution fails
RunAborted Scheduled search run was aborted
ActionSucceeded An action succeeds
ActionFailed An action fails
ActionMissing An action is missing
All of the following events:
Event Description
QueryStarted The query started
QueryStartFailed The query start failed
QueryStopped The query stopped
AlertUpdatedQueryRestarting Query restarting due to updated alert
IngestDelayTooHighHistoricQueryNotStarted Ingest delay is too high, no historic query started
PotentialPartialResult Potential partial result
QueryPollSucceeded The query poll succeeded
QueryPollFailed The query poll failed
FoundNoEvents Alert found no events
FoundEventsButThrottled Alert found events, but is throttled
TooFarBehindSkippingTime Alert is too far behind and events are skipped
ThrottleFieldValueLimitExceeded Throttle field value limit exceeded
TriggerLimitExceeded Trigger limit exceeded
Triggered Triggering actions succeeds
TriggeringFailed Triggering actions fails
ActionFailed An action fails
ActionMissing An action is missing
ActionSucceeded An action succeeds
TriggeringAborted Triggering failed permanently
plannedExecutionTime 1761893220000 Time the event was planned to occur. This timestamp is in milliseconds since the epoch (1st Jan 1970, 00:00) of the event. All events โ€”
triggered true Boolean flag that indicates if the trigger was triggered. RunSucceeded โ€”
error All actions associated with the scheduled search failed. The scheduled search will retry invoking the actions. If the run resulted in an error, the error message appears. ExecutionFailed
Event Description
QueryStartFailed The query start failed
QueryPollFailed The query poll failed
TriggeringFailed Triggering actions fails
QueryStopped The query stopped
warnings[0], warnings[1], and so on Triggered warning Warnings are an array field. If the run resulted in warnings, Triggered warning appears.
Event Description
RunSucceeded Scheduled search run succeeds
ExecutionFailed Scheduled search execution fails
Event Description
QueryPollSucceeded The query poll succeeded
QueryPollFailed The query poll failed
QueryStopped The query stopped
PotentialPartialResult Potential partial result
FoundNoEvents Alert found no events
FoundEventsButThrottled Alert found events, but is throttled
Triggered Triggering actions succeeds
TriggeringFailed Triggering actions fails
isRerun True Boolean indicating whether the scheduled search was a rerun. All events โ€”
actionId opZ5KnOyo6RDtreqhVk0nrEMgeCchxLJ Action ID associated with the event.
Event Description
ActionSucceeded An action succeeds
ActionFailed An action fails
ActionMissing An action is missing
Event Description
ActionSucceeded An action succeeds
ActionFailed An action fails
ActionMissing An action is missing
actionType LogScaleRepository Type of action triggered. For information about action types, see Actions.
Event Description
ActionSucceeded An action succeeds
ActionFailed An action fails
Event Description
ActionSucceeded An action succeeds
ActionFailed An action fails
retryable true When a scheduled search execution fails, this field indicates whether the failure is retryable (such as, transient errors such as timeouts, I/O errors, or HTTP 5xx responses) or non-retryable (permanent errors such as invalid configuration, missing actions, or blocked queries). True indicates that the scheduled search is retryable. ExecutionFailed โ€”
eventFileVersionId 4fSt8OKl1rqOGUhaeW1hwWLVllTDfQd7 Version ID returned by S3 for the event file from S3 actions. ActionSucceeded events where actionType is S3. An action succeeds where actionType is S3.
metadataFileVersionId 9NLJbTWleCi_p1LeT3zRpz5g8BttjGVv Version ID returned by S3 for the metadata file from S3 actions. ActionSucceeded events where actionType is S3. An action succeeds where actionType is S3.
eventId ย  Event ID associated with the event. โ€”
Event Description
Triggered Triggering actions succeeds
TriggeringFailed Triggering actions fails
TriggeringAborted Triggering failed permanently
isLiveQuery true Whether the query was a live query for the event. โ€” All events except ThrottleFieldValueLimitExceeded, and not on all QueryStartFailed or QueryStopped.

Examples log messages for scheduled search logs

The following examples show the order of log message you will see in different scenarios.

A run that is already too old when the previous one is done:

RunAborted

A run that is scheduled to run, but never gets to run before it is too old:

RunScheduled โ†’ RunAborted

A run that succeeds on first execution without triggering:

RunScheduled โ†’ ExecutionStarted โ†’ ExecutionSucceeded โ†’ RunSucceeded

A run that succeeds on first execution and triggers:

RunScheduled โ†’ ExecutionStarted โ†’ ActionSucceeded โ†’ ExecutionSucceeded โ†’ RunSucceeded

A run that succeeds on first execution, one action fails, another succeeds and a third one is missing:

RunScheduled โ†’ ExecutionStarted โ†’ ActionFailed โ†’ ActionSucceeded โ†’ ActionMissing โ†’ ExecutionSucceeded โ†’ RunSucceeded

A run that fails on first execution, and is then aborted:

RunScheduled โ†’ ExecutionStarted โ†’ ActionFailed โ†’ ExecutionFailed โ†’ RunAborted

A run that fails on first execution, then succeeds:

RunScheduled โ†’ ExecutionStarted โ†’ ActionFailed โ†’ ExecutionFailed โ†’ ExecutionStarted โ†’ ActionSucceeded โ†’ ExecutionSucceeded โ†’ RunSucceeded

Examples log messages for filter alert logs

The following examples show the order of log message you will see in different scenarios.

Alert running without any problems and without triggering:

Query started โ†’ Query poll succeeded โ†’ Alert found no events โ†’ Query poll succeeded (repeat every 10 seconds) โ†’ Alert found no events (repeat every 10 seconds)

Alert triggering a single action once:

Query started โ†’ Query poll succeeded โ†’ An action succeeds (for each event) โ†’ Triggering actions succeeds (for each event) โ†’ Query poll succeeded (repeat every 10 seconds) โ†’ Alert found no events (repeat every 10 seconds)

Alert triggering a single action once, then being throttled for a while:

Query started โ†’ Query poll succeeded โ†’ An action succeeds (for each event) โ†’ Triggering actions succeeds (for each event) โ†’ Query poll succeeded (repeat every 10 seconds) โ†’ Alert found events, but is throttled (repeat every 10 seconds) โ†’ ... Query poll succeeded (repeat every 10 seconds) โ†’ Alert found no events (repeat every 10 seconds)

Alert is behind, running historic query to catch up, then restarts live query:

Query stopped โ†’ Query started (repeat this and next for each historic time interval behind) โ†’ Query poll succeeded (repeat this and next for each historic time interval behind) โ†’ Alert found no events (repeat this and previous for each historic time interval behind) โ†’ Query started (isLiveQuery=true)