Analytics alerts

Open in ChatGPTOpen in Claude

Early access

Analytics alerts are available to selected accounts. Contact your Coralogix account representative to request access. Accounts without it do not see Analytics in the alert type list.

An analytics alert runs a DataPrime query on a schedule and alerts on its result. Use it when the other alert types cannot express what you need to watch: a value you compute yourself, a join across fields, or a condition that only makes sense after an aggregation.

The other alert types start from a signal and give you a fixed shape. An analytics alert starts from a query, so the alert is only as specific as the query you write.

What you need

• Early access to analytics alerts for your account.
• ALERTS:LOGSREADCONFIG to view analytics alerts, and ALERTS:LOGSUPDATECONFIG to create and edit them. Analytics alerts use the log alert permissions.
• A DataPrime query that returns the value you want to watch. See DataPrime.

Two types

Select Analytics in the alert type list, then choose how it fires:

Type	Fires when
Threshold	The tracked value crosses the level you set over a time frame.
Immediate	The query returns any matching result.

The type you choose appears on the alert and in the Type filter of the alert list as Analytics - Threshold or Analytics - Immediate.

Create an analytics alert

1. Navigate to Alerts, then select Create alert.

2. In Alert type, select Analytics, then Threshold or Immediate.

3. Under Query, write your DataPrime query, for example:

   source logs
   | filter $l.applicationname == 'checkout'
   | groupby $d.service:string as service aggregate count() as events

   The example reads the default logs dataset, but you are not limited to it. You can query any dataset that is available to you as the user creating the alert. If the query omits source, it reads the default logs dataset, so the example above behaves the same without its first line.

4. Select the Tracked value. This is the column from the query result the alert watches, events in the example above. Required for a threshold alert.

5. To alert separately for each row the query returns, select Use rows as permutations. Each row becomes its own alert instance, grouped by the columns you aggregated on.

6. Set the Condition, then continue to Response and Summary.

Notifications

Analytics alerts notify through Cases only. Alerts still appears in the Notify on step, but it is disabled, with a tooltip saying alert notifications are not available for analytics alerts.

Condition

A threshold alert's condition reads as a sentence: Evaluate over a time frame of a period, then Alert when tracked value is an operator and a number, with a priority.

Add further rules with Add condition to raise the priority as the value gets worse. Thresholds must get stricter as priority increases, so every rule can fire.

Evaluation frequency

Evaluation frequency controls how often the alert engine runs your query, separately from the time frame the query covers. You can find it in the Condition section of the Configuration step, below the condition rules, labelled Alert engine checks data every.

Frequency	Note
1 minute	High query consumption
5 minutes	High query consumption
10 minutes	Default
30 minutes
60 minutes

Shorter intervals detect issues sooner but consume more query resources, so the 1-minute and 5-minute options are marked High query consumption. Use them only for alerts that need near real-time detection.

Evaluation frequency and the time frame are independent. An alert evaluating every minute over a 10-minute frame re-reads the same 10 minutes of data every minute, overlapping each time.

Evaluation delay

If you do not set an evaluation delay, analytics alerts use a default of 5 minutes.

Missing data behavior

When there is no data decides what the alert reports when the query returns nothing: Set OK treats the absence as healthy, so the alert does not fire on a gap.

Auto retire sets how long a value the query stops returning stays on the alert before it is dropped. Without it, an instance that disappears from the results keeps its last state indefinitely.

Limits

The query has a 30-second timeout. If it takes longer to run, the alert does not evaluate.

An analytics alert that groups by one or more keys creates one instance per combination of values, and the combinations are capped at 10,000. Adding a group-by key multiplies the combinations, so a key with many distinct values can exceed the cap on its own. The editor warns before you save and names the maximum each field can carry.

A separate, lower limit applies to the chart rather than to evaluation: above 1,000 group-by permutations the drilldown chart is unavailable. The alert still evaluates normally.

Next steps

• Choose what the alert notifies on, and route it, in Configure notifications.
• Compare the alert types in Introduction to alerts.