User defined alerts – be notified in real time

User-Defined Alerts: Real-Time Notifications

The user-defined alerts in Coralogix will allow you to obtain real-time insights based on criteria of your own choosing. It is a very simple process which grants users full flexibility, advanced alerting options, and real-time push notifications.

Here’s how it is done.

1) From the main dashboard, open the alert definition interface:

dashboard pointing on alerts

2) Then, click on the “ + “ sign:

coralogix alert definition

3) The final screen contains 4 sections. Here’s a breakdown of what you are to do under each:

  • First Section: Define the general alert parameters: Name, Alert severity, and Alert timeframe.
  • Second Section: Define the alert criteria: text/template, metadata, and log severity.
  • Third Section: Set the alert rule: whether you want it to alert immediately or you want to define a rule for More/Less occurrences per timeframe
  • Fourth Section: Define the notification you like to receive. It could be an e-mail address, Slack room (see instructions for Slack alias below) or both.

coralogix alert definition

4) To define an advanced alert, use / before and after your text, and follow these instructions: 

  • To perform a free text search, simply enter a text string. For example, if you are searching your web server logs, enter safari to define an alert on all fields for the term safari (without/around the alert text).
  • To define an alert on a value in a specific field, prefix the value with the name of the field. For example, enter /environment:production/ to define an alert on all the entries that contain the value production in the environment field.
  • To define an alert on a range of numeric values, use the bracketed range syntax [START_VALUE TO END_VALUE]. For example, to define an alert on entries that have 4xx status codes, enter /status.numeric:[400 TO 499]/.
  • To specify more complex alert criteria, use the Boolean operators AND, OR, and NOT. For example, to define an alert on entries that have 4xx status codes and have an extension of PHP, enter /status.numeric:[400 TO 499] AND extension:php/.
  • To define an alert when a regular expression matches a value, wrap your regex with ‘/’ and use it as the expression for the field. For example, to define an alert the regions west-europe-1, west-europe-2, west-us-1, west-us-2, west-us-3 etc., enter /region:/west-(europe|us)-[0-9]+//.

Example: define an alert on logs from your production with status codes 5xx not originating from west-europe or west-us, use this expression:

/environment:production AND status.numeric:[500 TO 599] NOT region:/west-(europe|us)-[0-9]+//

The final step is to click on the ‘V’ mark on the right-hand side of the screen.

You’re all set! Now you can view your alerts: 

The “Alert logs” view shows the logs which triggered the alert:

alert logs view

“Logs” view shows all the logs prior and after the alert hit, with the hit itself highlighted:

full alert logs view

To add a slack notification to your alert:

1) Go to settings, click “integrations” and click the ‘+’ sign on the righthand side:

coralogix slack integration

2) Select “Slack”, add the desired alias (it’s best to use the Slack room name), add the room webhook, click save.

3) If you don’t see your new integration under your alert definition, try to refresh your browser

**To find your webhook, click here: (while logged in to Slack), choose the room name, click “Add incoming webhook integration” and copy the webhook you got into Coralogix. 

add slack to coralogix alerts

Enjoy a whole new world of actionable real-time insights on your production systems with Coralogix!

Signup to Coralogix
WordPress Lightbox