As part of Coralogix [Alerting](https://coralogix.com/docs/user-guides/alerting/introduction-to-alerts/index.md), metric alerts monitor metric behavior and trigger notifications when predefined thresholds are met or exceeded. These alerts help you maintain system performance, reliability, and security. Metric alerts evaluate specific metrics in your Coralogix dashboard and notify you when conditions cross the thresholds you configure. They monitor critical performance indicators, such as CPU utilization, response times, error rates, and resource usage in cloud environments, and provide early warning when values deviate from expected behavior. You can create PromQL-based metric alerts for standard metric sources such as [Prometheus](https://coralogix.com/https/coralogixcom/docs/integrations/metrics/prometheus/) and [CloudWatch](https://coralogix.com/docs/integrations/aws/aws-cloudwatch/aws-cloudwatch-metrics-processing/index.md) or for metrics extracted from logs through [Events2Metrics](https://coralogix.com/docs/user-guides/monitoring-and-insights/events2metrics/index.md) ## What do you need - Ingest metrics into Coralogix. - Define a PromQL query that returns the values you want to evaluate. ## Create an alert 1. Go to **Alerts**, then **Alert management**. 1. Select **Create alert**. 1. In **Alert type**, select **Metric**. ## Add alert details In the **Details** section: - Enter the **alert name**. - Enter the **alert description**, which appears in alert notifications. - Add **labels**, or nest labels using `key:value`. - Select **Set as security alert** to add the `alert_type:security` label so you can filter these alerts in the **Incidents** page. ## Define the PromQL query In the **Query** section: - Enter the expression in **Search query**. - Select **PromQL Documentation** if you need reference material. Note - The system displays auto-complete suggestions as you type. - Aggregate values by application, subsystem, instance, or any metric label. - Add labels to narrow a metric, for example: ```text application_error_count{area="x"} ``` - Use `by()` to aggregate and control notification grouping, for example: ```text sum by(instance) (node_filesystem_size_bytes) ``` ## Configure conditions Use the **Conditions** section to define when the metric alert triggers. The system evaluates each condition rule in priority order and triggers the alert when the highest-priority rule evaluates to true. ### Select the alert condition type In **Alert when**, select one of the following operators: - **Less than threshold** - **Less than or equals threshold** - **More than threshold** - **More than or equals threshold** - **More than usual** (dynamic alert) - **Less than usual** (dynamic alert) Dynamic alerts use behavior-based baselines. All other operators evaluate static thresholds. ## Set condition rules Each rule follows this structure: When the query returns: - `` - `` - `for at least` / `at least once in` / `for over` - `