In the alert rule —> Select log data source —> Configure query statement and extract value ValueKey —> Use simple mode to set the threshold for ValueKey within a specified time.
Configuration Scenario 1: Query the log count for status codes 404 and 405 in proxy logs. If the result is greater than 0 and not equal to 3, trigger an alert.
Query statement: status:404 OR status:405 | SELECT status AS status, count(*) AS count GROUP BY status. Here, the condition is based on the query result, so in the condition check, $A > 0 and $A != 3 are used.
Configuration Scenario 2: Configure different metrics for result comparison. Trigger an alert if status:404 is greater than 100 and status:405 is greater than 1.
To achieve combined judgment on different query values, you need to fill in two separate query analysis statements to extract values for comparison. The conditions use extracted values $A and $B for comparison.
Note: Similar to PromQL, if the data labels are inconsistent, the query analysis statements will be treated as two separate curves, and comparison operations cannot be performed.
