# Ratio alerts

Copy as Markdown[Open in ChatGPT](https://chatgpt.com/?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fuser-guides%2Falerting%2Fcreate-an-alert%2Flogs%2Fratio-alerts.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)[Open in Claude](https://claude.ai/new?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fuser-guides%2Falerting%2Fcreate-an-alert%2Flogs%2Fratio-alerts.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)

A ratio alert divides the count of one log query by the count of another and fires when the resulting ratio crosses a threshold. Use it to track proportions rather than raw counts, for example error code 504 responses as a share of all responses, denied requests as a share of all requests, or traffic from one region as a share of total traffic.

## What you need[​](#what-you-need "Direct link to What you need")

* Access to Coralogix with permission to create alerts
* Two log queries whose ratio you want to monitor

## Define the ratio alert[​](#define-the-ratio-alert "Direct link to Define the ratio alert")

To start, go to **Alerts**, then select **Create alert**. The alert creation wizard opens on the Query step. This page covers the parts of the wizard specific to ratio alerts. For the shared steps, see the [alert creation wizard](https://coralogix.com/docs/docs/user-guides/alerting/configuring-alert-definition/.md).

### Query step[​](#query-step "Direct link to Query step")

1. Select the **Ratio** alert type.
2. Define **Query 1** (the numerator) and **Query 2** (the denominator). For each query, write a DataPrime or Lucene query, give it an alias that appears in notifications, and narrow it with application, subsystem, or severity filters.

The ratio is the count from Query 1 divided by the count from Query 2 over the evaluation window.

#### Query examples[​](#query-examples "Direct link to Query examples")

* Error rate: Query 1 `status:504`, Query 2 `_exists_:status`. The ratio of 504 responses to all responses. A higher-than-usual ratio can indicate operational issues.
* Restricted traffic: Query 1 `NOT client_addr:/172\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/`, Query 2 `_exists_:client_addr`. The ratio of traffic outside the allowed range to all traffic. An abnormal ratio can indicate an attack.
* Failed requests: Query 1 `request_status:success`, Query 2 `response_status:rejectrequest`. The proportion of requests that were not answered successfully.

### Condition step[​](#condition-step "Direct link to Condition step")

Set the trigger logic for the ratio:

* **Threshold**: alert when the ratio of Query 1 to Query 2 is more than or less than the value you set over the time window.
* **Group by**: evaluate the ratio separately for each combination of label values, for example per `region` or per `pod_name`. Only logs that contain all selected fields are counted.
* **Trigger on infinity**: select whether to alert when Query 2 returns 0. When the denominator is 0, the ratio is infinite.

Set routing and naming in the [alert creation wizard](https://coralogix.com/docs/docs/user-guides/alerting/configuring-alert-definition/.md) Notification and Details steps, then select **Create alert**. The alert becomes active within 15 minutes.

## Related resources[​](#related-resources "Direct link to Related resources")

[Configure alert definition](https://coralogix.com/docs/docs/user-guides/alerting/configuring-alert-definition/.md)[Notification Center](https://coralogix.com/docs/docs/user-guides/notification-center/introduction/.md)[Cases](https://coralogix.com/docs/docs/user-guides/cases/overview/.md)[Incidents](https://coralogix.com/docs/docs/user-guides/alerting/incidents/.md)

## Next steps[​](#next-steps "Direct link to Next steps")

Set up volume-based alerting for your logs with [Threshold alerts](https://coralogix.com/docs/docs/user-guides/alerting/create-an-alert/logs/threshold-alerts/.md).