Flow alerts
Flow alerts notify you when several alerts are triggering together across a sequence of time-bound stages. Use them to correlate signals across logs, metrics, traces, and security, so you alert on a combination of conditions rather than isolated symptoms, and surface a likely root cause.
For example, to catch an HTTP error spike alongside high CPU, configure a flow alert with a high CPU utilization alert in the first stage and a high HTTP error rate alert in the second.
What you need
- Access to Coralogix with permission to create alerts
- The individual alerts you want to chain, already created
How a flow is structured
You assemble a flow from two building blocks in the flow builder:
- Group: a logical combination of individual alerts, joined with the OR, AND, and NOT operators.
- Stage: one or more groups that must trigger within a specified time frame. A flow is an ordered series of stages.
Shows how individual alerts combine into groups, and groups into a time-bound stage.
How a stage is satisfied
Coralogix evaluates the stages in order, from left to right.
- Stage 1 is the entry point. The flow starts only when stage 1's alert triggers. Until then, nothing else is assessed.
- Each later stage opens a time frame. That stage is satisfied if its alert is in a triggered state at any point inside the frame.
- When the alert started does not matter. An alert that began triggering before the previous stage still satisfies its stage, as long as it is still triggering when the stage is assessed.
That last point is the one that surprises people. A flow describes alerts that overlap in time, not a strict chain of events in sequence.
Take a two-stage flow with a 30-minute frame on the second stage:
| What happens | Result |
|---|---|
| Stage 1 triggers at 12:00. Stage 2 triggers at 12:05. | Fires |
| Stage 1 triggers at 12:00. Stage 2 has been triggering since 11:55 and has not resolved. | Fires |
| Stage 1 triggers at 12:00. Stage 2 triggers at 12:35, outside the frame. | Does not fire |
| Stage 1 never triggers. | Does not fire, whatever stage 2 does |
The second row is the behavior worth knowing. Stage 2's alert started before stage 1's and the flow still fires, because the stage asks whether the alert is triggering, not when it started.
Limitations
- The cumulative time frame across all stages cannot exceed 168 hours (1 week). A larger value resets to zero.
- A single flow alert can combine a maximum of 30 alerts.
- The following alert types do not support the NOT operator:
- New value
- Unique count
- Immediate
Build a flow alert
To create a flow alert, go to Alerts, then select Create alert. The alert creation wizard opens on the Query step. The Flow type uses the same four-step flow as every alert (Query, then Condition, then Notification, then Details). Naming, labels, and scheduling now come last on the Details step, not first; the steps below cover the flow-specific work.
Query and condition: build the sequence
- On the Query step, select the Flow alert type, then select Open Flow Builder.
- Drag existing alerts from the left panel into the builder workspace. Hover an alert to see its Query, Conditions, and Group by fields.
- Organize the alerts into groups and stages, and set a time frame for each stage.
- Select Apply to save the flow.
- Select the Group by keys for the flow.
The available Group by keys are the intersection of the keys across the alerts in the flow. If alert A is grouped by Region and Cluster, and alert B is grouped by Region and Pod, the flow can only group by Region. Hover an alert in the builder to see its available keys.
To keep a constituent alert from firing on its own, enable Phantom mode on that alert. Only the flow then triggers a notification and opens an incident, while its building-block alerts stay silent.
For the Notification and Details steps, including routing, cadence, alert scheduling, naming, and labels, see Configuring an alert definition and Define alert details.
Example
The following flow notifies you when successful orders drop because of a failed database cleanup task that ran 24 hours earlier.
Shows a two-stage flow linking an earlier failure to a later business-metric drop.
Related resources
Next steps
Configure alert name, description, and labels in Define alert details.