AXaxiom
Monitors

GET /monitors

Changed on

Lists monitors in the organization, sorted by name. Only returns monitors that query at least one dataset visible to the caller. Labels are resolved unless exclude=labels.

Request

Query parameters

exclude'labels'

Exclude resolved label objects from each monitor response. The labelIds and labelNames fields are still returned.

labelstring[]

Filter by label names in your organization. Repeat the parameter for multiple names, for example ?label=prod&label=team-a. Names match case-insensitively after whitespace normalization; duplicates count once. Commas are part of a name, not separators. Reading resources never creates missing labels.

labelMatch'any' | 'all'

How to combine label names: any (the default) requires at least one requested label on a resource; all requires every requested label on that same resource. For example, ?label=prod&label=team-a matches either label, while ?label=prod&label=team-a&labelMatch=all requires both. Unknown names have no matches with any and make all return no resources. Without label parameters, labelMatch has no effect.

labelIdsstring[]

Return monitors assigned every specified label ID. When combined with label names, both filters must match; labelMatch applies only to names.

Response

Monitors visible to the caller.

alertOnNoDataboolean

Whether to alert when no data is received

aplQuerystring

APL (Axiom Processing Language) query string used for monitoring. This query defines what data to analyze and how to process it. At least one of aplQuery or mplQuery must be provided.

columnNamestring

Name of the column to monitor

compareDaysnumber

Number of days to compare for anomaly detection

descriptionstring

Detailed description of the monitor's purpose

disabledboolean

Whether the monitor is currently disabled

disabledUntilstring date-time nullable

Timestamp until when the monitor should remain disabled

includeChartboolean

Whether to include a query chart in triggered notifications

intervalMinutesinteger

How frequently the monitor should run, in minutes. Minimum value is 1 minute.

mplQuerystring

MPL (Metrics Processing Language) query string for metrics-based monitoring. Use this as an alternative to aplQuery for metrics datasets. At least one of aplQuery or mplQuery must be provided.

namestring required

Name of the monitor

notifierIdsstring[]

List of notifier IDs that will receive alerts. Notifiers can be email, Slack, webhook endpoints, etc.

notifyByGroupboolean

Whether to group notifications

notifyEveryRunboolean

Whether to send notifications on every check

operator'Below' | 'BelowOrEqual' | 'Above' | 'AboveOrEqual' | 'AboveOrBelow'

Comparison operator for threshold checks:

  • Below: Trigger when value < threshold
  • BelowOrEqual: Trigger when value <= threshold
  • Above: Trigger when value > threshold
  • AboveOrEqual: Trigger when value >= threshold
  • AboveOrBelow: Trigger when value is outside a range
rangeMinutesinteger

Time window to evaluate in each check, in minutes. For example, "last 5 minutes of data"

resolvableboolean

Whether the alert can be manually resolved

secondDelaynumber

Number of seconds to move each run's query window into the past, so data that arrives late is included. For example, with a value of 300, a run at 10:05 queries up to 10:00.

skipResolvedboolean

Whether to skip resolved alerts

thresholdnumber double

Threshold value for triggering the alert

tolerancenumber

Tolerance percentage for anomaly detection

triggerAfterNPositiveResultsnumber

Number of runs among the last triggerFromNRuns runs, including the current one, that must meet the trigger condition for the monitor to trigger. The current run must always meet it. For example, set both fields to 3 to trigger only after 3 consecutive runs meet the condition. If unset or 0, the first run that meets the condition triggers. Values above triggerFromNRuns are lowered to it when the monitor is saved. Applies to Threshold and AnomalyDetection monitors.

triggerFromNRunsnumber

Number of most recent runs, including the current one, that the monitor looks at when deciding whether to trigger. Has no effect unless triggerAfterNPositiveResults is also set. Applies to Threshold and AnomalyDetection monitors.

type'Threshold' | 'MatchEvent' | 'AnomalyDetection' required

Type of monitoring check to perform:

  • Threshold: Compares a numeric value against a threshold
  • MatchEvent: Looks for specific events or patterns
  • AnomalyDetection: Identifies unusual patterns based on historical data
createdAtstring date-time

Timestamp when the monitor was created

createdBystring

ID of the user who created the monitor

createdByAgentboolean

true when the MCP server created this monitor

datasetsstring[]

Dataset names referenced by the monitor query.

idstring required

Unique identifier for the monitor

labelIdsLabelID[] required

IDs of labels assigned to this monitor.

labelNamesstring[] required

Names of assigned labels, including with exclude=labels; [] when unassigned.

lastErrorstring

Most recent error encountered while evaluating the monitor.

updatedAtstring date-time

Timestamp when the monitor was last updated

Example response

[
  {
    "alertOnNoData": true,
    "aplQuery": "| where severity = 'error' | count() > 100",
    "columnName": "cpu_usage",
    "compareDays": 7,
    "description": "Monitors CPU usage and alerts when it exceeds 90%",
    "disabledUntil": "2024-04-01T00:00:00Z",
    "intervalMinutes": 5,
    "mplQuery": "test-metrics:http_request_duration_seconds",
    "name": "Production CPU Monitor",
    "notifierIds": [
      "z0NfJw64aKagPOBBIJ"
    ],
    "operator": "Above",
    "rangeMinutes": 5,
    "resolvable": true,
    "secondDelay": 300,
    "threshold": 90,
    "tolerance": 10,
    "triggerAfterNPositiveResults": 3,
    "triggerFromNRuns": 3,
    "type": "Threshold",
    "createdAt": "2024-03-20T10:00:00Z",
    "createdBy": "usr_789xyz",
    "datasets": [
      "production-logs"
    ],
    "id": "QgOLFXIvK0ZbYf3tZE",
    "updatedAt": "2024-03-20T10:30:00Z"
  }
]

Changes

  • v2ce3b16fc7723Revision changes
    • warning

      removed the optional property ///// from the response with the status

    • info

      removed the NewValues enum value from the ///// response property for the response status

  • v2e3baf3b85e8dRevision changes
    • warning

      added the new NewValues enum value to the ///// response property for the response status

    • info

      added the new optional query request parameter label

    • info

      added the new optional query request parameter labelMatch

    • info

      added the optional property ///// to the response with the status

    • info

      added the optional property ///// to the response with the status

    • info

      added the optional property // to the response with the status

    • info

      added the required property // to the response with the status