Create Alert
DescriptionYou can create an alert to notify users when specific data appears in the logs. An alert is based on a query.
Request
URLURL
Request Body
{
"alertType": "per-event/windowed",
"name": "string",
"operator": "GREATER_THAN",
"periodInMillis": 0,
"query": {
"constraints": {
"constraints": "QueryConstraint Object",
"operator": "AND"
},
"name": "string"
},
"severityThreshold": {
"key": 0
}
}
Alert name
Type of alert
Possible values are: per-event/windowed
Map of severity(CRITICAL, IMMEDIATE, WARNING, INFO) and threshold value
Time period that indicates how frequently the alert should be evaluated (in milliseconds)
Condition for triggering the alert
Possible values are: GREATER_THAN , GREATER_THAN_EQUAL , LESS_THAN , LESS_THAN_EQUAL , EQUAL
Additional information associated with the alert
List of tags associated with this alert
Alert ID
Lists the RCA parameters if Root Cause Analysis (RCA) is enabled, otherwise it’s null
Indicates whether the alert is enabled or disabled
Notification configs associated with the alert
Custom fields or all logs corresponding to the alert included in the alert notification
Email recipients for the alert notifications
Alert description
Unique ID associated with the org
Alert recommendations for troubleshooting
ID of the content pack that the alert belongs to if the alert is part of a content pack
Map of severity(CRITICAL, IMMEDIATE, WARNING, INFO) to the list of notification recipients (email and webhook)
End time for snoozing the alert (in milliseconds)
Start time for snoozing the alert (in milliseconds)
Source of the alert
Possible values are: USER_DEFINED
Minimum threshold for triggering the alert
Authentication
Response
Response BodyResponse Body
201 Created
{
"alertMetadata": {
"key": "string"
},
"alertType": "per-event/windowed",
"contentPackId": "string",
"cspOrgId": "string",
"description": "string",
"emailRecipients": [
"string"
],
"enabled": false,
"entityTagAssociation": [
{
"tagId": "string",
"tagName": "string"
}
],
"id": "string",
"logRcaConfig": {
"autoRcaEnabled": false,
"id": "string",
"mergeThreshold": 0,
"minFilterThreshold": 0,
"rankThreshold": 0,
"timeWindowMin": 0
},
"name": "string",
"notificationConfigs": [
"string"
],
"notificationMetadata": {
"customFields": [
"string"
],
"isIncludeAllLogs": false,
"outputFormat": "TABLE"
},
"operator": "GREATER_THAN",
"periodInMillis": 0,
"query": {
"aggregationFunctions": [
{
"fieldName": "string",
"functionName": "COUNT"
}
],
"constraints": {
"constraints": "QueryConstraint Object",
"fieldName": "string",
"operator": "AND",
"tags": [
"string"
],
"value": "string"
},
"contentPackId": "string",
"description": "string",
"groupByTerms": [
{
"fieldName": "string",
"groupByType": "EACH_VALUE"
}
],
"name": "string",
"queryId": "string",
"relationFunctions": [
{
"relationName": "string",
"relationType": "LOGS",
"shardInfo": {
"key": "string"
}
}
],
"source": "USER_DEFINED"
},
"recommendations": "string",
"severityThreshold": {
"key": 0
},
"severityToNotificants": {
"key": {
"emailRecipients": [
"string"
],
"notificationConfigs": [
"string"
],
"sendToVrops": false
}
},
"snoozeEndTimeInMillis": 0,
"snoozeStartTimeInMillis": 0,
"source": "USER_DEFINED",
"threshold": 0
}
Alert name
Type of alert
Possible values are: per-event/windowed
Map of severity(CRITICAL, IMMEDIATE, WARNING, INFO) and threshold value
Time period that indicates how frequently the alert should be evaluated (in milliseconds)
Condition for triggering the alert
Possible values are: GREATER_THAN , GREATER_THAN_EQUAL , LESS_THAN , LESS_THAN_EQUAL , EQUAL
Additional information associated with the alert
List of tags associated with this alert
Alert ID
Lists the RCA parameters if Root Cause Analysis (RCA) is enabled, otherwise it’s null
Indicates whether the alert is enabled or disabled
Notification configs associated with the alert
Custom fields or all logs corresponding to the alert included in the alert notification
Email recipients for the alert notifications
Alert description
Unique ID associated with the org
Alert recommendations for troubleshooting
ID of the content pack that the alert belongs to if the alert is part of a content pack
Map of severity(CRITICAL, IMMEDIATE, WARNING, INFO) to the list of notification recipients (email and webhook)
End time for snoozing the alert (in milliseconds)
Start time for snoozing the alert (in milliseconds)
Source of the alert
Possible values are: USER_DEFINED
Minimum threshold for triggering the alert
