AXaxiom
Monitors

POST /monitors

Changed on

Creates a monitor. Axiom runs the monitor's query once before saving it and rejects the request if the query fails, for example because it's invalid or references a dataset that doesn't exist. labelIds replaces assignments when supplied; [] clears them. Omitted or null labelIds preserves assignments on updates and creates an unlabeled resource on creation. IDs must belong to existing labels in your organization and are validated before saving.

Request

Request body

alertOnNoDataboolean

Whether to alert when no data is received

aplQuerystring

APL (Axiom Processing Language) query string used for monitoring. This query defines what data to analyze and how to process it. At least one of aplQuery or mplQuery must be provided.

columnNamestring

Name of the column to monitor

compareDaysnumber

Number of days to compare for anomaly detection

descriptionstring

Detailed description of the monitor's purpose

disabledboolean

Whether the monitor is currently disabled

disabledUntilstring date-time nullable

Timestamp until when the monitor should remain disabled

includeChartboolean

Whether to include a query chart in triggered notifications

intervalMinutesinteger

How frequently the monitor should run, in minutes. Minimum value is 1 minute.

mplQuerystring

MPL (Metrics Processing Language) query string for metrics-based monitoring. Use this as an alternative to aplQuery for metrics datasets. At least one of aplQuery or mplQuery must be provided.

namestring required

Name of the monitor

notifierIdsstring[]

List of notifier IDs that will receive alerts. Notifiers can be email, Slack, webhook endpoints, etc.

notifyByGroupboolean

Whether to group notifications

notifyEveryRunboolean

Whether to send notifications on every check

operator'Below' | 'BelowOrEqual' | 'Above' | 'AboveOrEqual' | 'AboveOrBelow'

Comparison operator for threshold checks:

  • Below: Trigger when value < threshold
  • BelowOrEqual: Trigger when value <= threshold
  • Above: Trigger when value > threshold
  • AboveOrEqual: Trigger when value >= threshold
  • AboveOrBelow: Trigger when value is outside a range
rangeMinutesinteger

Time window to evaluate in each check, in minutes. For example, "last 5 minutes of data"

resolvableboolean

Whether the alert can be manually resolved

secondDelaynumber

Number of seconds to move each run's query window into the past, so data that arrives late is included. For example, with a value of 300, a run at 10:05 queries up to 10:00.

skipResolvedboolean

Whether to skip resolved alerts

thresholdnumber double

Threshold value for triggering the alert

tolerancenumber

Tolerance percentage for anomaly detection

triggerAfterNPositiveResultsnumber

Number of runs among the last triggerFromNRuns runs, including the current one, that must meet the trigger condition for the monitor to trigger. The current run must always meet it. For example, set both fields to 3 to trigger only after 3 consecutive runs meet the condition. If unset or 0, the first run that meets the condition triggers. Values above triggerFromNRuns are lowered to it when the monitor is saved. Applies to Threshold and AnomalyDetection monitors.

triggerFromNRunsnumber

Number of most recent runs, including the current one, that the monitor looks at when deciding whether to trigger. Has no effect unless triggerAfterNPositiveResults is also set. Applies to Threshold and AnomalyDetection monitors.

type'Threshold' | 'MatchEvent' | 'AnomalyDetection' required

Type of monitoring check to perform:

  • Threshold: Compares a numeric value against a threshold
  • MatchEvent: Looks for specific events or patterns
  • AnomalyDetection: Identifies unusual patterns based on historical data
labelIdsLabelID[]

Existing label IDs; replaces assignments when supplied, clears with [], and preserves them when omitted or null.

Example request

{
  "alertOnNoData": true,
  "aplQuery": "| where severity = 'error' | count() > 100",
  "columnName": "cpu_usage",
  "compareDays": 7,
  "description": "Monitors CPU usage and alerts when it exceeds 90%",
  "disabledUntil": "2024-04-01T00:00:00Z",
  "intervalMinutes": 5,
  "mplQuery": "test-metrics:http_request_duration_seconds",
  "name": "Production CPU Monitor",
  "notifierIds": [
    "z0NfJw64aKagPOBBIJ"
  ],
  "operator": "Above",
  "rangeMinutes": 5,
  "resolvable": true,
  "secondDelay": 300,
  "threshold": 90,
  "tolerance": 10,
  "triggerAfterNPositiveResults": 3,
  "triggerFromNRuns": 3,
  "type": "Threshold"
}

Response

Created monitor.

alertOnNoDataboolean

Whether to alert when no data is received

aplQuerystring

APL (Axiom Processing Language) query string used for monitoring. This query defines what data to analyze and how to process it. At least one of aplQuery or mplQuery must be provided.

columnNamestring

Name of the column to monitor

compareDaysnumber

Number of days to compare for anomaly detection

descriptionstring

Detailed description of the monitor's purpose

disabledboolean

Whether the monitor is currently disabled

disabledUntilstring date-time nullable

Timestamp until when the monitor should remain disabled

includeChartboolean

Whether to include a query chart in triggered notifications

intervalMinutesinteger

How frequently the monitor should run, in minutes. Minimum value is 1 minute.

mplQuerystring

MPL (Metrics Processing Language) query string for metrics-based monitoring. Use this as an alternative to aplQuery for metrics datasets. At least one of aplQuery or mplQuery must be provided.

namestring required

Name of the monitor

notifierIdsstring[]

List of notifier IDs that will receive alerts. Notifiers can be email, Slack, webhook endpoints, etc.

notifyByGroupboolean

Whether to group notifications

notifyEveryRunboolean

Whether to send notifications on every check

operator'Below' | 'BelowOrEqual' | 'Above' | 'AboveOrEqual' | 'AboveOrBelow'

Comparison operator for threshold checks:

  • Below: Trigger when value < threshold
  • BelowOrEqual: Trigger when value <= threshold
  • Above: Trigger when value > threshold
  • AboveOrEqual: Trigger when value >= threshold
  • AboveOrBelow: Trigger when value is outside a range
rangeMinutesinteger

Time window to evaluate in each check, in minutes. For example, "last 5 minutes of data"

resolvableboolean

Whether the alert can be manually resolved

secondDelaynumber

Number of seconds to move each run's query window into the past, so data that arrives late is included. For example, with a value of 300, a run at 10:05 queries up to 10:00.

skipResolvedboolean

Whether to skip resolved alerts

thresholdnumber double

Threshold value for triggering the alert

tolerancenumber

Tolerance percentage for anomaly detection

triggerAfterNPositiveResultsnumber

Number of runs among the last triggerFromNRuns runs, including the current one, that must meet the trigger condition for the monitor to trigger. The current run must always meet it. For example, set both fields to 3 to trigger only after 3 consecutive runs meet the condition. If unset or 0, the first run that meets the condition triggers. Values above triggerFromNRuns are lowered to it when the monitor is saved. Applies to Threshold and AnomalyDetection monitors.

triggerFromNRunsnumber

Number of most recent runs, including the current one, that the monitor looks at when deciding whether to trigger. Has no effect unless triggerAfterNPositiveResults is also set. Applies to Threshold and AnomalyDetection monitors.

type'Threshold' | 'MatchEvent' | 'AnomalyDetection' required

Type of monitoring check to perform:

  • Threshold: Compares a numeric value against a threshold
  • MatchEvent: Looks for specific events or patterns
  • AnomalyDetection: Identifies unusual patterns based on historical data
createdAtstring date-time

Timestamp when the monitor was created

createdBystring

ID of the user who created the monitor

createdByAgentboolean

true when the MCP server created this monitor

datasetsstring[]

Dataset names referenced by the monitor query.

idstring required

Unique identifier for the monitor

labelIdsLabelID[] required

IDs of labels assigned to this monitor.

labelNamesstring[] required

Names of assigned labels, including with exclude=labels; [] when unassigned.

lastErrorstring

Most recent error encountered while evaluating the monitor.

updatedAtstring date-time

Timestamp when the monitor was last updated

Example response

{
  "alertOnNoData": true,
  "aplQuery": "| where severity = 'error' | count() > 100",
  "columnName": "cpu_usage",
  "compareDays": 7,
  "description": "Monitors CPU usage and alerts when it exceeds 90%",
  "disabledUntil": "2024-04-01T00:00:00Z",
  "intervalMinutes": 5,
  "mplQuery": "test-metrics:http_request_duration_seconds",
  "name": "Production CPU Monitor",
  "notifierIds": [
    "z0NfJw64aKagPOBBIJ"
  ],
  "operator": "Above",
  "rangeMinutes": 5,
  "resolvable": true,
  "secondDelay": 300,
  "threshold": 90,
  "tolerance": 10,
  "triggerAfterNPositiveResults": 3,
  "triggerFromNRuns": 3,
  "type": "Threshold",
  "createdAt": "2024-03-20T10:00:00Z",
  "createdBy": "usr_789xyz",
  "datasets": [
    "production-logs"
  ],
  "id": "QgOLFXIvK0ZbYf3tZE",
  "updatedAt": "2024-03-20T10:30:00Z"
}

Changes

  • v2ce3b16fc7723Revision changes
    • breaking

      removed the enum value NewValues of the request property ////

    • warning

      removed the request property ////

    • warning

      removed the optional property //// from the response with the status

    • info

      removed the NewValues enum value from the //// response property for the response status

  • v2e3baf3b85e8dRevision changes
    • breaking

      added subschema #2 to the request body allOf list

    • breaking

      the request's body type changed from object to no type

    • warning

      removed the request property

    • warning

      removed the request property

    • warning

      removed the request property

    • warning

      removed the request property

    • warning

      removed the request property

    • warning

      removed the request property

    • warning

      removed the request property

    • warning

      removed the request property

    • warning

      removed the request property

    • warning

      removed the request property

    • warning

      removed the request property

    • warning

      removed the request property

    • warning

      removed the request property

    • warning

      removed the request property

    • warning

      removed the request property

    • warning

      removed the request property

    • warning

      removed the request property

    • warning

      removed the request property

    • warning

      removed the request property

    • warning

      removed the request property

    • warning

      removed the request property

    • warning

      removed the request property

    • warning

      removed the request property

    • warning

      added the new NewValues enum value to the //// response property for the response status

    • info

      added the optional property //// to the response with the status

    • info

      added the optional property //// to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the required property / to the response with the status