---
title: Analytics alerts
description: Alert on the result of a DataPrime query. Analytics alerts run your own query on a schedule you choose, track one value from the result, and fire immediately on a match or when the tracked value crosses a threshold.
url: https://coralogix.com/docs/user-guides/alerting/create-an-alert/analytics/
product: alerts
feature: Log Alerts
feature_id: logs.alerts
feature_identifier: alerts/logs.alerts
last_updated: '2026-11-11'
---

# Analytics alerts

Early access

Analytics alerts are available to selected accounts. Contact your Coralogix account representative to request access. Accounts without it do not see **Analytics** in the alert type list.

An analytics alert runs a DataPrime query on a schedule and alerts on its result. Use it when the other alert types cannot express what you need to watch: a value you compute yourself, a join across fields, or a condition that only makes sense after an aggregation.

The other alert types start from a signal and give you a fixed shape. An analytics alert starts from a query, so the alert is only as specific as the query you write.

## What you need

* Early access to analytics alerts for your account.
* `ALERTS:LOGSREADCONFIG` to view analytics alerts, and `ALERTS:LOGSUPDATECONFIG` to create and edit them. Analytics alerts use the log alert permissions.
* A DataPrime query that returns the value you want to watch. See [DataPrime](https://coralogix.com/docs/dataprime/introduction/welcome-to-the-dataprime-reference.md).

## Two types

Select **Analytics** in the alert type list, then choose how it fires:

| Type          | Fires when                                                     |
| ------------- | -------------------------------------------------------------- |
| **Threshold** | The tracked value crosses the level you set over a time frame. |
| **Immediate** | The query returns any matching result.                         |

The type you choose appears on the alert and in the **Type** filter of the alert list as **Analytics - Threshold** or **Analytics - Immediate**.

## Create an analytics alert

1. Navigate to **Alerts**, then select **Create alert**.

2. In **Alert type**, select **Analytics**, then **Threshold** or **Immediate**.

3. Under **Query**, write your DataPrime query, for example:

   ```
   source logs

   | filter $l.applicationname == 'checkout'

   | groupby $d.service:string as service aggregate count() as events
   ```

   The example reads the default logs dataset, but you are not limited to it. You can query any dataset that is available to you as the user creating the alert. If the query omits `source`, it reads the default logs dataset, so the example above behaves the same without its first line.

4. Select the **Tracked value**. This is the column from the query result the alert watches, `events` in the example above. Required for a threshold alert.

5. To alert separately for each row the query returns, select **Use rows as permutations**. Each row becomes its own alert instance, grouped by the columns you aggregated on.

6. Set the **Condition**, then continue to **Response** and **Summary**.

## Notifications

Analytics alerts notify through **Cases** only. **Alerts** still appears in the **Notify on** step, but it is disabled, with a tooltip saying alert notifications are not available for analytics alerts.

## Condition

A threshold alert's condition reads as a sentence: **Evaluate over a time frame of** a period, then **Alert when tracked value is** an operator and a number, with a priority.

Add further rules with **Add condition** to raise the priority as the value gets worse. Thresholds must get stricter as priority increases, so every rule can fire.

### Evaluation frequency

**Evaluation frequency** controls how often the alert engine runs your query, separately from the time frame the query covers. You can find it in the **Condition** section of the **Configuration** step, below the condition rules, labelled **Alert engine checks data every**.

| Frequency  | Note                   |
| ---------- | ---------------------- |
| 1 minute   | High query consumption |
| 5 minutes  | High query consumption |
| 10 minutes | Default                |
| 30 minutes |                        |
| 60 minutes |                        |

Shorter intervals detect issues sooner but consume more query resources, so the 1-minute and 5-minute options are marked **High query consumption**. Use them only for alerts that need near real-time detection.

Evaluation frequency and the time frame are independent. An alert evaluating every minute over a 10-minute frame re-reads the same 10 minutes of data every minute, overlapping each time.

### Evaluation delay

If you do not set an evaluation delay, analytics alerts use a default of **5 minutes**.

### Missing data behavior

**When there is no data** decides what the alert reports when the query returns nothing: **Set OK** treats the absence as healthy, so the alert does not fire on a gap.

**Auto retire** sets how long a value the query stops returning stays on the alert before it is dropped. Without it, an instance that disappears from the results keeps its last state indefinitely.

## Limits

The query has a **30-second** timeout. If it takes longer to run, the alert does not evaluate.

An analytics alert that groups by one or more keys creates one instance per combination of values, and the combinations are capped at **10,000**. Adding a group-by key multiplies the combinations, so a key with many distinct values can exceed the cap on its own. The editor warns before you save and names the maximum each field can carry.

A separate, lower limit applies to the chart rather than to evaluation: above **1,000** group-by permutations the drilldown chart is unavailable. The alert still evaluates normally.

## Next steps

* Choose what the alert notifies on, and route it, in [Configure notifications](https://coralogix.com/docs/user-guides/alerting/configure-notifications/settings.md).
* Compare the alert types in [Introduction to alerts](https://coralogix.com/docs/user-guides/alerting/introduction-to-alerts.md#select-the-right-alert-type).