In the alert rule —> Select log data source —> Configure query statement and extract value ValueKey —> Use simple mode to set the threshold for ValueKey within a specified time.
Configuration Scenario 1: Query the log count for status codes 200 and 301. If the result is greater than 10 and less than 15, trigger an alert.
The query statement is the same as the one introduced above: status:403 OR status:402 | SELECT status AS status, count(*) AS count GROUP BY status. Here, the condition is based on the query result, so in the condition check, $A > 10 and $A < 15 are used.
Configuration Scenario 2: Configure different metrics for result comparison. Trigger an alert if status:200 is greater than 100 and status:301 is greater than 1.
To achieve combined judgment on different query values, you need to fill in two separate query analysis statements to extract values for comparison. The conditions use extracted values $A and $B for comparison.
Note: Similar to PromQL, if the data labels are inconsistent, the query analysis statements will be treated as two separate curves, and comparison operations cannot be performed.
