The new
value alert
type allows you to specify a key
in a given log.
If this key is set to a value
that has not been seen before
within a given timeframe,
then you will be alerted.
This is very useful
in a number of instances.
For example,
if you have a closed system
and wish to alert that a new IP address,
or if you wish to detect new error codes
from a third party
API that you haven't seen before.
Begin by defining the log
query that you wish to run.
The goal of this
query is to bring back
your log documents.
As usual,
you can narrow your query down
to specific applications
subsystem and severity,
which is always a good idea.
Here you'll select your key.
This is the key on your log document
that you're tracking for a new value.
Be mindful of the notice here.
Your key needs to have fewer
than 50,000 unique values
within the selected timeframe.
If it has more,
then this alert will not trigger.
50,000 unique values is very generous,
so it's unlikely you'll
run into this problem.
Note the timeframe next to your key.
It's important that you decide
on the correct time window
for your new value alerts.
For example,
if you choose 12 hours,
then a value that hasn't appeared in 13
hours would be considered
a new value and trigger the alert.
The new value alert allows you to detect
when something unexpected
has happened
or brand new behavior
has surfaced in your system.
This is a key tool in tackling
the many "known unknowns"
that present themselves in your system
and would otherwise go unnoticed.