Trigger conditions
Last Updated：2025-11-14
Function overview
Trigger condition expressions evaluate whether an alert should be triggered. The execution statement results serve as input variables for these expressions. If the evaluation deems the expression true, an alert will be activated.
Syntax
| Operator | Description | Example |
|---|---|---|
$N.__QUERYCOUNT__ |
Number of execution statement results, where N is the corresponding execution statement number, with a maximum value of 100.Execution statements without SQL: Number of original log entries matching the retrieval criteria; Execution statements with SQL: Number of results returned by the SQL (Note: The number of SQL results does not refer to the statistical result of the SQL. For example, if a count(*) result is 0, the number of results is still 1). | $1.__QUERYCOUNT__ |
$N.keyname |
Refer to the output of an execution statement, where N is the respective execution statement number and keyname corresponds to a field in the execution statement's result. | $1.ErrCount $1.value |
+ |
Summation operator | $1.ErrCount + $1.FatCount > 10 |
- |
Subtraction operator | $1.Count - $1.InfoCount > 100 |
* |
Multiplication operator | $1.RequestMilSec * 1000 > 10 |
/ |
Division operator | $1.RequestSec / 1000 > 0.01 |
% |
Modulo operator | $1.keyA % 10 == 0 |
== |
Comparison operator: Equal to | $1.ErrCount == 100 $1.level == "Error" |
> |
Comparison operator: greater than | $1.ErrCount > 100 |
< |
Comparison operator: less than | $1.pv < 100 |
>= |
Comparison operator: greater than or equal to | $1.ErrCount >= 100 |
<= |
Comparison operator: less than or equal to | $1.pv <= 100 |
!= |
Comparison operator: not equal to | $1.level != "Info" |
() |
Brackets, controlling operation precedence | ($1.a + $1.b) / $1.c > 100 |
&& |
Logical operator: AND | $1.ErrCount > 100 && $1.level == "Error" |
|| |
Logical operator: or | $1.ErrCount > 100 || $1.level == "Error" |
Example of trigger condition configuration
Log Sample
| @stream | Level | CountSkipRows |
|---|---|---|
| stream1 | Error | 23 |
| stream1 | Info | 0 |
| stream2 | Error | 1 |
CASE1: Monitor aggregated metrics and set to trigger an alarm when it exceeds a certain threshold
Execution statement: select CountSkipRows Trigger condition: $1.CountSkipRows>10
CASE2: After filtering keywords, monitor aggregated metrics and set to trigger an alarm when it exceeds a certain threshold
Execution statement: match stream1 | SELECT CountSkipRows Trigger condition: $1.CountSkipRows>10
CASE3 Trigger an alarm when Error-level logs appear
Execution statement: match Level: Error Trigger conditions:
$1.__QUERYCOUNT__>0
Or
Execution statement: match Level: Error ｜ select count(*) as cnt Trigger conditions: $1.cnt >0