We support two kinds of alerts, which are evaluated for specified stream:
- Scheduled alerts
- Real time alerts
To navigate to alerts in OpenObserve, select preferred organization using organization selection control, then click on menu , which will take one to alerts list screen. The screen lists all alerts for selected organization.
Alert screen details:
- Search in listed alerts
- Add new alert
- Name of the alert - used during notification
- Stream type and stream name for alert
- Conditions or custom SQL / PromQL used for alert evaluation
- Start / Pause alert
- Edit alert
- Delete alert
Scheduled alerts are evaluated at frequency for the condition of the alert, over duration specified as part of alert. If the condition evaluates to true a notification is sent to alert destination. Additionally user can delay notification after a notification is generated once for specified delay.
A user wants to be notified of condition if error code 500 occurs more than 15 time for duration of 2 mins & wants such evaluation to happen at 1 min frequency.
We can configure the alert like this:
Real time alerts
Real time alerts are evaluated at ingestion time based on condition specified , they are evaluated per record.
A user wants to be notified of when API response time is more than 100 ms
Please note we selected
Slack destination for demo, but you can add others in