Alerting

Central Logging can monitor your logs and send alerts when specific conditions are met. You define alert rules using SQL or FTS queries, and notifications are delivered through configured notification channels.

Alert Rules

An alert rule defines what to look for and when to fire. You can create alert rules from the Alerts page or directly from the search page (the query and source are pre-filled).

Each alert rule has:

• Name — A descriptive name for the rule
• Title — The subject line used in notifications
• Query — A SQL query or FTS query to evaluate
• Description — Additional context sent with the alert notification
• Log Source — The log source(s) to monitor. A single rule can monitor multiple log sources.
• Alert Condition — Choose to alert when the query returns results, or when the query returns no results (useful for detecting missing expected events)
• Max Frequency — How long the rule stays quiet after it notifies you
• Active/Inactive — Toggle rules on and off without deleting them

SQL Alert Rules

SQL alert rules run a SQL query against your log source. If the query returns results (or no results, depending on your condition), an alert is created.

FTS Alert Rules

FTS alert rules use the same full-text search syntax as the search page. This is useful for simpler keyword-based alerts.

Evaluation and Throttling

Alert rules are evaluated every 5 minutes. When a rule fires, the notification goes out within a minute.

To prevent alert fatigue, each rule has a Max Frequency. It is the minimum time between two notifications from the same rule. Pick one of 5 minutes, 15 minutes, 1 hour, 6 hours or once a day. New rules default to once a day.

Nothing shorter than 5 minutes is offered, because rules are only evaluated every 5 minutes.

Match the setting to the problem. A failing payment webhook is worth hearing about every 15 minutes until you fix it. A disk filling up is not.

When the condition is no longer met, the rule stops showing as firing within about 8 minutes. No all-clear notification is sent.

For worked examples, see alerting on errors in your logs.

Notification Channels

Notification channels define where alert messages are sent. Central Logging supports:

Alerts go to one channel, not to all of them. Tick Send alerts to this channel on the channel you want. Only one channel can hold that setting, so ticking it on a second channel clears the first. If no channel is marked, alerts go to the first active channel by creation order. The Alerts page labels the channel that receives them.

Slack

Send alerts to a Slack channel using an Incoming Webhook. To set up:

1. Create an Incoming Webhook in your Slack workspace
2. In Central Logging, go to Alerts and create a new Notification Channel
3. Select Slack Webhook and paste the webhook URL

Telegram

Send alerts to a Telegram chat using a bot. To set up:

1. Create a Telegram bot via @BotFather and get the bot token
2. Get the chat ID for the target chat or group
3. In Central Logging, create a new Notification Channel
4. Select Telegram and enter the bot token and chat ID

Pushover

Send alerts to your phone as a push notification. To set up:

1. Create an application at pushover.net/apps and copy its API token
2. Copy your user key from pushover.net
3. In Central Logging, create a new Notification Channel
4. Select Pushover and enter the API token and user key

Email

Send alerts by email through any SMTP server — a provider such as Fastmail or Amazon SES, your company mail server, or a local relay. To set up:

1. In Central Logging, create a new Notification Channel
2. Select Email (SMTP)
3. Enter the SMTP server as host:port, e.g. smtp.fastmail.com:587
4. Enter the SMTP username and password. Leave the username blank if your server accepts mail without a login, such as a local relay on port 25
5. Enter the From address and one or more To addresses, separated by commas

Port 465 connects with implicit TLS. Other ports upgrade to STARTTLS when the server offers it. If your provider issues app-specific passwords for SMTP (Fastmail and Gmail both do), use one of those rather than your account password.

Testing

Each notification channel has a Test button so you can verify the integration is working before relying on it for alerts. The test sends to the channel you clicked, which is not always the channel alerts use. Check the Alerts page for the “Alerts go here” label.

Notification channels can be toggled active or inactive independently of alert rules. An inactive channel never receives alerts, even when it is the one marked to receive them.