idstring uuid required
Unique identifier for this alert.
namestring
Human-readable name for this alert. Defaults to 'Untitled alert' on create when omitted.
enabledboolean
Whether the alert is actively being evaluated. Disabling resets the state to not_firing.
threshold_countinteger
Number of matching log entries that constitutes a threshold breach within the evaluation window. Defaults to 100. Use 0 with the 'above' operator to fire on any matching log.
threshold_operator'above' | 'below'
- above - Above
- below - Below
window_minutesinteger
Time window in minutes over which log entries are counted. Allowed values: 5, 10, 15, 30, 60.
check_interval_minutesinteger required
How often the alert is evaluated, in minutes. Server-managed.
state'not_firing' | 'firing' | 'pending_resolve' | 'errored' | 'snoozed' | 'broken' required
- not_firing - Not firing
- firing - Firing
- pending_resolve - Pending resolve
- errored - Errored
- snoozed - Snoozed
- broken - Broken
evaluation_periodsinteger
Total number of check periods in the sliding evaluation window for firing (M in N-of-M).
datapoints_to_alarminteger
How many periods within the evaluation window must breach the threshold to fire (N in N-of-M).
cooldown_minutesinteger
Minimum minutes between repeated notifications after the alert fires. 0 means no cooldown.
snooze_untilstring date-time nullable
ISO 8601 timestamp until which the alert is snoozed. Set to null to unsnooze.
next_check_atstring date-time nullable required
When the next evaluation is scheduled. Server-managed.
last_notified_atstring date-time nullable required
When the last notification was sent. Server-managed.
last_checked_atstring date-time nullable required
When the alert was last evaluated. Server-managed.
consecutive_failuresinteger required
Number of consecutive evaluation failures. Resets on success. Server-managed.
last_error_messagestring nullable required
Error message from the most recent errored check, or null if the alert's most recent check was successful. Sourced from LogsAlertEvent without denormalization so retention-aware cleanup rules stay the only source of truth.
destination_typesLogsAlertDestinationTypeEnum[] required
Notification destination types configured for this alert — e.g. 'slack', 'webhook'. Empty list means no notifications will fire. One or more destinations should be added after creating an alert.
first_enabled_atstring date-time nullable required
When the alert was first enabled. Null means the alert is still in draft state.
created_atstring date-time required
When the alert was created.
updated_atstring date-time nullable required
When the alert was last modified.