OpenObserve provides two main alert types: Standard and Real-time. Standard alerts run at scheduled intervals, evaluating conditions against your data. Real-time alerts continuously monitor data streams for immediate detection. Both types support SQL queries and quick condition builders for alert definition.

Alert conditions can be created using either SQL queries or the quick condition builder. The quick builder allows you to select columns, operators, and values with an AND operator for multiple conditions. SQL mode provides full query flexibility for complex alert scenarios. Conditions can include aggregations with configurable thresholds and evaluation periods.

The platform supports multiple notification destinations that can be configured for each alert. Notifications include customizable templates for alert messages. You can set silence periods to prevent notification fatigue, specifying durations during which repeat notifications are suppressed. Each destination can be configured independently.

Thresholds in OpenObserve alerts include both occurrence counts and time windows. You can specify how many times a condition must be met within a period to trigger an alert. The system supports comparison operators (=, >, <, etc.) for threshold definition. Aggregation windows can be configured to evaluate data over specific time periods.

For standard alerts, you can configure:

• Evaluation frequency (how often the alert condition is checked)
• Evaluation period (the time window for data analysis)
• Threshold occurrences (how many times a condition must be met)
• Silence periods (duration to suppress repeat notifications)

Real-time alerts continuously monitor incoming data streams. They evaluate conditions as data arrives, providing immediate notification when conditions are met. Real-time alerts support the same condition-building and notification options as standard alerts, but with continuous evaluation instead of scheduled checks.

The platform provides a comprehensive alert management interface where you can:

• Create and edit alert definitions
• Configure notification destinations
• Set up alert conditions and thresholds
• Define evaluation periods and frequencies
• Monitor alert status and history
• Configure silence periods *Add custom variables for alert context

OpenObserve provides a preview feature for testing alert conditions before deployment. For SQL-based alerts, you can verify query results directly in the interface. Alert configurations can be tested without enabling notifications to ensure proper condition evaluation.