Alerts

Alerts enable continuous monitoring of log, metric, or trace data to detect critical issues or operational patterns that require attention. Define conditions using a natural language builder or custom SQL, and receive notifications through email or webhooks such as Slack.

To open alerts, go to Reliability in the left navigation and select All Alerts. The Alerts page has four tabs: All Alerts, Notification Destinations, Destination Templates, and Alert Library.

Alert types

OpenObserve supports four types of alerts:

• Scheduled alerts: Run at fixed intervals to evaluate aggregated or historical data. Use for routine monitoring and trend analysis. For example, every 10 minutes, the alert evaluates your data and checks if the average response time exceeds 500ms. If the condition is met, the alert sends a notification.
• Real-time alerts: Monitor data continuously and trigger instantly when conditions are met. Use for critical events requiring instant action. For example, when a specific error pattern appears in your logs, the alert sends a notification within seconds.
• Composite alerts: Combine the current state of existing alerts with boolean logic (AND, OR, NOT). Use to reduce alert noise by paging only when several signals line up. See Composite Alerts for details.
• Anomaly detection (Enterprise and Cloud): Use machine learning to detect unusual patterns in your data without manually setting thresholds. See Anomaly Detection for details.

Alert creation layout

The alert creation form uses a flat, two-tab layout:

Header: alert name (click to rename) and the folder it is saved in
Alert Type: Scheduled, Realtime, Anomaly, Composite; then Stream Type and Stream Name
├── Alert Rules tab (required)
│   ├── Conditions: query mode, condition sentence, filters, schedule
│   └── Settings: look back window, hold for, cooldown, destinations, incidents
└── Advanced tab
    ├── Compare with Past (scheduled only)
    ├── Deduplication (scheduled only)
    └── Additional Settings (templates, variables, description, priority, tags)

Until you rename it, a new alert's name is generated from the stream and condition and updates as you change them.

The right panel displays a live Preview of your alert evaluation and an auto-updating Summary of your configuration.

Core components

Stream

The data source being monitored. Select a stream type (logs, metrics, or traces) and a specific stream name below the Alert Type selector.

Condition sentence

The condition builder lets you define alert logic using a natural language sentence. In the default count mode, the condition reads:

"Alert if total events >= 3 matching logs found"

When you select an aggregation function (avg, min, max, sum, etc.), the sentence expands to:

"Alert if avg of cpu_usage is >= 80"

See Alert Conditions and Filters for details on all available functions and modes.

Query modes

OpenObserve supports three query modes for defining conditions:

• Builder: Point-and-click condition sentence with filters. Suitable for most use cases.
• SQL: Write custom SQL queries with a full-screen editor, AI assistance, and field browser. Required for advanced filtering and aggregations.
• PromQL: Use Prometheus query language for metrics alerts.

Check every (frequency)

How often the alert evaluation runs. Set the interval in minutes, or switch to a cron expression for precise scheduling. Real-time alerts run continuously and do not have a frequency setting.

Look back window (period)

The time window of data evaluated per alert run. If the look back window is 30 minutes, the alert evaluates the last 30 minutes of data each run.

Destination

Where alert notifications are sent. Choose one or combine multiple:

• Email: Send to team members or distribution lists. Requires SMTP configuration.
• Webhook: Send to external systems via HTTP. Prebuilt destinations cover Slack, Microsoft Teams, PagerDuty, Opsgenie, ServiceNow, Jira, and Discord.

In Enterprise editions, the destination picker also lists Workflows that the alert can start.

Cooldown period

The cooldown period prevents duplicate notifications by temporarily pausing alert triggers after firing. Set this to at least 10 minutes to avoid notification storms during sustained incidents.

Creates incident

Toggle this on to automatically create an incident in the Incidents page when the alert triggers. This enables incident tracking and correlation across multiple alerts.

Live preview and summary

The right panel provides real-time feedback as you configure your alert:

• Preview: Evaluates your conditions against recent data and shows whether the alert would trigger. Displays the number of matching data points and whether the threshold is met.
• Summary: Generates a human-readable description of your complete alert configuration. Auto-updates as you change any field. Clickable summary segments jump to the corresponding form field.

Advanced settings

The Advanced tab provides additional configuration for scheduled alerts:

• Compare with Past: Compare current alert evaluations against historical reference windows to detect relative changes. See Compare with Past for details.
• Deduplication: Group similar alerts by fingerprint fields and time window to reduce notification noise.
• Additional Settings: Override notification templates, add context variables, set a description, customize row templates, and set a Priority and Tags. See Advanced Alert Configuration.

Alert folders

Use folders to organize alerts on the Alerts page. All alerts are stored in the default folder unless you assign them to a different folder.

To create a folder, click + in the Folders panel on the Alerts page, enter a name and description, and click Save. Use the Search Folder box to find a folder. You can also pick or create a folder from the folder selector under the alert name while creating an alert. In the alert search box, choose This folder or All folders to search the current folder or every folder.

Next steps

• Scheduled Alerts: create scheduled and SQL alerts with advanced configuration.
• Real-time Alerts: create alerts that trigger instantly on ingestion.
• Composite Alerts: combine existing alerts into a boolean expression.
• Alert Conditions and Filters: deep dive into condition modes, functions, and filters.
• Alert History: view alert trigger history.
• Downtimes: silence notifications during maintenance windows.
• Anomaly Detection: ML-based anomaly alerts.
• Import and Export Alerts: bulk alert management.
• Alert Library: add ready-made alerts from a curated catalog.
• Alert Calibration: find noisy, silent, and failing alerts from their run history.
• Alert Destinations: configure notification channels.
• Templates: customize notification content.

Need some help?

• Join our Community Slack
• Or Contact support