Tracing alerts
Tracing alerts notify you when spans matching your filters exceed a latency threshold. Use them to catch slow or failing operations on specific services, tags, applications, or subsystems, so you find performance bottlenecks before they affect more users.
A tracing alert evaluates spans you select on the Query step and fires based on how many qualifying spans occur on the Condition step.
What you need
- Access to Coralogix with permission to create alerts
- Trace data ingesting from the services you want to monitor
Build a tracing alert
To create a tracing alert, go to Alerts, then select Create alert. The alert creation wizard opens on the Query step. The Tracing type uses the same four-step flow as every alert (Query, then Condition, then Notification, then Details); the parts below are specific to tracing.
Query: select spans and filters
- On the Query step, select the Tracing alert type.
- Set Latency is above (ms) to the maximum latency you tolerate. Spans slower than this value count toward the alert.
- Narrow the spans with filters:
- Span tags: add a tag as a Key and Value pair to include only matching spans. The value can be matched with Is, Starts with, Includes, or Ends with.
- Application, Subsystem, and Services: scope the alert to specific sources, or leave All selected. Each span can carry a different application or subsystem.
Condition: trace count threshold
On the Condition step, define how many qualifying spans trigger the alert:
- Trigger immediately on a match, or require a number of occurrences within a time window.
- The alert fires when the count threshold is met for an aggregated value within the time frame.
- With Group by set, matching spans are aggregated by the selected fields, and the alert fires on the unique combination of those values. Only spans that include all selected group-by fields are counted.
For the Notification and Details steps, including routing, cadence, alert scheduling, naming, and labels, see Configuring an alert definition. To silence a tracing alert so it can serve as a building block in a flow alert without firing on its own, enable Phantom mode on the Notification step.
Related resources
Next steps
Combine multiple alerts into a sequence-based trigger with Flow alerts.