VictoriaLogs log alerting uses LogsQL for log statistical analysis to detect anomalies and trigger alerts.
Configuration Guide
Query Statistics
Query Condition
Enter the LogsQL stats query in the query condition input box. The result is assigned to variable $A.
Query Format: <filter_conditions> | stats <stats_function>
Click the “Data Preview” button to view query results and verify the query is correct.
Threshold Judgment
Set alert thresholds based on query statistics results. For example, $A > 10 triggers an alert when the value exceeds 10.
Please ensure all variables have data and their labels are consistent, otherwise threshold judgment cannot be performed.
No Data
Configure the handling strategy when query returns no data.
LogsQL Query Syntax
Filter Conditions
Keyword Query
error # Query logs containing "error"
"connection timeout" # Query logs containing exact phrase
Field Filtering
_stream:{host="server1"} # Match stream labels
level:=error # Exact field match
level:error # Field contains value
status:>=500 # Numeric comparison
Logical Operators
error AND timeout # Contains both
error OR warning # Contains either
error NOT debug # Exclude
Wildcards and Regex
err* # Prefix match
/error|warning/i # Regex match (i for case-insensitive)
Time Filtering
Use _time field to filter by time range, which is very common in alerting scenarios:
_time:1m # Last 1 minute
_time:5m # Last 5 minutes
_time:10m # Last 10 minutes
_time:30m # Last 30 minutes
_time:1h # Last 1 hour
_time:1d # Last 1 day
Time range queries:
_time:[now-5m, now] # Last 5 minutes (same as _time:5m)
_time:[2024-01-01, 2024-01-02] # Specific date range
_time:["2024-01-01 10:00", "2024-01-01 12:00"] # Specific time range
Combined usage examples:
_time:5m AND level:=error # Error logs in last 5 minutes
_time:10m AND status:>=500 # 5xx errors in last 10 minutes
Stats Pipe
Queries must use the | stats pipe for statistics. Common functions:
| Function | Description | Example |
|---|---|---|
count() |
Count log entries | ` |
count_uniq(field) |
Count unique field values | ` |
sum(field) |
Sum values | ` |
avg(field) |
Average value | ` |
min(field) |
Minimum value | ` |
max(field) |
Maximum value | ` |
Group By
Use by (field) to group results. Each group generates independent alerts:
error | stats by (host) count() as count
For detailed LogsQL syntax, refer to VictoriaLogs Documentation
Usage Examples
Example 1: Error Log Count Monitoring (5 minutes)
Query Condition:
_time:5m AND level:=error AND _stream:{service="payment"} | stats count() as count
Threshold: $A > 10
Example 2: Error Monitoring Grouped by Host (5 minutes)
Query Condition:
_time:5m AND level:=error | stats by (host) count() as count
Threshold: $A > 50
Each host triggers independent alerts.
Example 3: 5xx Status Code Monitoring (10 minutes)
Query Condition:
_time:10m AND status:>=500 AND status:<600 | stats count() as count
Threshold: $A > 100
Example 4: Group by Service and Status Code (10 minutes)
Query Condition:
_time:10m AND status:>=400 | stats by (service, status) count() as count
Threshold: $A > 50
Example 5: Average Response Time Monitoring (5 minutes)
Query Condition:
_time:5m AND _stream:{app="api-gateway"} | stats avg(response_time) as avg_rt
Threshold: $A > 1000
Example 6: Keyword Alerting (10 minutes)
Query Condition:
_time:10m AND ("timeout" OR "connection refused" OR "out of memory") | stats count() as count
Threshold: $A > 5
Example 7: Regex Pattern Matching (5 minutes)
Query Condition:
_time:5m AND /exception|panic|fatal/i AND _stream:{env="production"} | stats by (service) count() as count
Threshold: $A > 20
Example 8: Unique User Count Monitoring (30 minutes)
Query Condition:
_time:30m AND level:=error | stats count_uniq(user_id) as affected_users
Threshold: $A > 100
