Composite log event settings

Home > Select Project > Alert > Event Configuration > Composite Log tab

You can set alert notifications by filtering collected log data against conditions. Log monitoring must be activated to use log events. For more information on activating log monitoring, refer to the log documentation for each product.

• Composite log event: An event is triggered when the number of logs that meet the log search conditions within the configured data query range reaches or exceeds the threshold count.

Note

Permission

Alert configuration permission is required to configure composite metrics events. Alert configuration permission can be set by clicking the icon for the member to grant permission in Home Screen > Select Project > Management > Integrated Member Management.

Default options

• Search: Search for events by selecting an event name or event notification tag

• JSON download/upload: Event rules can be directly edited through the JSON editor, or downloaded as a file, modified, and re-uploaded

• Notification message settings: Select detailed items for the message to receive and edit the content for each item

• + Add event: Add a new log event

  Table | Composite log event list configuration

  Item	Description
  Event name	Event name used as the notification title
  Template	Composite log template
  Category	Log classification name (log folder name)
  Rule	Conditions that trigger the event
  Additional notification when event is resolved	Whether to receive notifications in normal (RECOVERED) status when Critical and Warning level events are resolved - Enabled: Sends a RECOVERED notification when transitioning from in-progress → normal status, and the in-progress/resolved status can be distinguished in event history - Disabled: A one-time event occurs each time the threshold is exceeded
  Pause event notifications	Pauses the same event notification for a specified time after an event notification is triggered - Available times: Disabled, 5 min, 10 min, 15 min, 20 min, 30 min, 1 hour, 2 hours, 3 hours, 6 hours, 12 hours, 1 day - If resolved notifications are enabled, no notification is sent for the same event during the selected time after receiving a normal (RECOVERED) status notification
  Interval	Time range for querying log data
  Event notification tags	User or group (notification tag) to receive the event notification
  	Edit and delete events
  	Whether the event is active - Enabled: Event occurs when conditions are met - Disabled: Event does not operate and conditions are not checked

Event settings

The composite log event feature triggers alert notifications when the number of logs matching the log search conditions within the configured data query range reaches or exceeds the threshold count.

Add composite log event

1. Click the Composite Log tab in Alert > Event Configuration.

2. Click the [ + Add event ] button on the right side of the screen.

3. Set the log event conditions in the Add event rule window. For details, refer to Basic settings, Detail settings, and Additional settings.

   

4. When configuration is complete in the Add event rule window, click the [ Save ] button.

Basic settings

• Event name: Enter a name to use as the event title.

• Event activation: When the toggle button is activated, an event occurs when conditions are met.

• Level: Select the event level (Critical, Warning, Info).

Detail settings

Configure Template (preset), Message, Category, Filter, and Event trigger conditions.

Template (preset)

Selecting a predefined preset automatically configures the filter, query type, and event trigger conditions. You can modify the settings after selecting a preset.

Composite log template types

Preset	Query type	Default rule
None	none	rows > 10
2xx status code count	count	count > 10
3xx status code count	count	count > 10
4xx status code count	count	count > 10
5xx status code count	count	count > 10
Normal status code (2xx, 3xx) count	count_v2	include_minus_exclude_count > 10
Error status code (4xx, 5xx) count	count_v2	include_minus_exclude_count > 10
Error received count	count	count > 10
Exception received count	count	count > 10
Log count per second	rps	rps > 100
Field aggregation (Aggregation)	aggr	avg > 1000
Rate	rate	rate > 10
Unique value count (Cardinality)	cardinality	cardinality > 100
Percentile	percentile	p99 > 3000

Message

Enter the notification message to receive when an event occurs. You can use variables in the message to compose dynamic notifications.

• Example: Message ${host} error ${count} occurred → Notification message web-01 error 15 occurred

Table | Message variables

Variable	Description	Usage condition
${count}	Number of logs matching the condition	Always available
${groupField}	Grouping field name	Grouped notifications only
${groupValue}	Grouping field value	Grouped notifications only
${fieldName}	Grouping field value (referenced directly by field name)	Grouped notifications only

Note

The ${count} variable can be used in all notifications regardless of grouping. The ${groupField}, ${groupValue}, and ${fieldName} variables are only substituted when a grouping field is configured.

Category

Select the log classification name (log folder name) from the list or enter it directly. You can enter the search key and search value only after selecting a category.

Filter

Enter log search conditions using Lucene query syntax. Two input modes are supported.

• Filter mode : Build a query by selecting fields and values.

• Code mode : Enter Lucene queries directly.

  Table | Lucene query examples

  Query	Description
  level:ERROR	Logs where the level field is ERROR
  status_nxx:status_4xx OR status_nxx:status_5xx	4xx or 5xx status codes
  appender:accessLog	Logs from the accessLog appender
  response_time.n:*	Logs where the response_time.n field exists
  host:web-01 AND level:ERROR	Error logs from host web-01

Event trigger conditions

Configure by query type. Additional settings are displayed depending on the selected template (preset) or query type.

Table | Event trigger condition key meanings

Key	Meaning
rows / count	Number of logs matching the filter condition
rps	Log count per second (count / interval in seconds)
avg	Average value of the target field
sum	Sum of the target field values
min	Minimum value of the target field
max	Maximum value of the target field
rate	Numerator count / denominator count × 100 (%)
cardinality	Number of unique values in the target field
p99 / p95 / p90 / p75 / p50	Percentile values of the target field
include_minus_exclude_count	Include filter count − exclude filter count

• Count (count / none): Counts the number of logs matching the configured filter conditions.

  Table | Count settings

  Setting	Description
  Filter	Log search condition (Lucene query)
  Event trigger condition	count or matching logs {operator} {threshold} (e.g., count > 10)

• Log count per second (rps): Calculates the number of logs per second (Requests Per Second) matching the configured filter conditions. The total count during the interval is divided by the interval in seconds.

  Table | Log count per second settings

  Setting	Description
  Filter	Log search condition (Lucene query)
  Event trigger condition	RPS {operator} {threshold} (e.g., rps > 0.5)

• Field aggregation (aggr): Calculates the aggregated value (average, sum, min, max) of the specified numeric field. The aggregation method can be selected from a dropdown in the event trigger condition.

  Table | Field aggregation settings

  Setting	Description
  Filter	Log search condition (Lucene query)
  Target field	Numeric field to aggregate (e.g., response_time.n)
  Event trigger condition	avg/sum/min/max {operator} {threshold} (e.g., avg > 1000)

• Rate: Calculates the percentage (%) ratio of the numerator filter count to the denominator filter count. Useful for monitoring the ratio of specific conditions against all logs.

  Table | Rate settings

  Setting	Description
  Filter (numerator)	Log condition for the numerator (e.g., level:ERROR)
  Denominator filter	Log condition for the denominator (e.g., level:*)
  Event trigger condition	Rate (%) {operator} {threshold} (e.g., rate > 10)

  • Example: Filter level:ERROR, denominator filter level:*, rule rate > 10 → Alert triggered when the error rate among all logs exceeds 10%

• Unique value count (cardinality): Counts the number of unique values in the specified field. Useful for detecting an abnormally large variety of values.

  Table | Unique value count settings

  Setting	Description
  Filter	Log search condition (Lucene query)
  Target field	Field to calculate unique values for (e.g., host)
  Event trigger condition	Unique value count {operator} {threshold} (e.g., cardinality > 100)

• Percentile: Calculates the percentile value of the specified numeric field. Useful for monitoring tail latency in response times. Changing the percentile selection automatically updates the key in the event trigger condition.

  Table | Percentile settings

  Setting	Description
  Filter	Log search condition (Lucene query)
  Target field	Numeric field to calculate percentile for (e.g., response_time.n)
  Percentile	Select from P99, P95, P90, P75, P50
  Event trigger condition	P99/P95/... {operator} {threshold} (e.g., p99 > 3000)

  Table | Percentile meanings

  Percentile	Meaning
  P50	Median. 50% of all data is at or below this value
  P75	75% of all data is at or below this value
  P90	90% of all data is at or below this value
  P95	95% of all data is at or below this value
  P99	99% of all data is at or below this value

• Include/exclude count (count_v2): Calculates the net count by subtracting the exclude filter count from the include filter count.

  Table | Include/exclude count settings

  Setting	Description
  Filter (include)	Log conditions to include (e.g., status_nxx:status_4xx OR status_nxx:status_5xx)
  Filter exclude	Log conditions to exclude (e.g., status_nxx:status_4xx)
  Denominator filter	Denominator for ratio calculation (optional)
  Event trigger condition	Include-exclude count {operator} {threshold} (e.g., include_minus_exclude_count > 10)

  • Example: Filter status_nxx:status_4xx OR status_nxx:status_5xx, filter exclude status_nxx:status_4xx → Alert triggered when the net 5xx count (4xx+5xx minus 4xx) exceeds 10

Group by field (Group By)

When a group by field is configured, alert conditions are evaluated independently for each value of that field. Select the field to group by from the dropdown. Clicking the dropdown shows a list of available fields for the current category with autocomplete.

• Example: Filter level:ERROR, group by field host, rule rows > 3

  Table | Grouping comparison

  Item	Without grouping	With grouping
  Evaluation unit	All logs aggregated as one	Independent aggregation per group value
  Alert occurrence	1 alert	One per group meeting the condition
  Alert title	Event title	[Group value] Event title
  Stateful	State transition based on all logs	Independent state transition per group

  • [web-01] Error alert — 8 errors from web-01 → alert triggered

  • [web-02] Error alert — 5 errors from web-02 → alert triggered

  • [api-01] Error alert — 2 errors from api-01 → condition not met, no alert

  Note

  When Additional notification when event is resolved is enabled, the ABNORMAL → RECOVERED state transition occurs independently per group. For example, when errors from web-01 are resolved, a [web-01] RECOVERED notification is triggered, with no effect on other hosts.

Additional settings

• Interval: Check alert conditions at the selected time interval (unset, 1 min, 5 min, 10 min, 30 min, 1 hour, 12 hours).

• Mute: After an event occurs, the same event is not triggered during the selected time (unset, 1 min, 5 min, 10 min, 30 min, 1 hour, 12 hours).

• Event operation time: Set tags to activate the event during specific time periods (work/non-work/maintenance hours, etc.). If no tag is set, the event operates 24 hours a day when activated.

  1. Click + Add.
  2. Click + Create new tag in Event operation time.
  3. In Create event operation time tag, select the tag name, day of week, time, and color, then click the [ Apply ] button.
  4. Created tags can be viewed in the tag list and are applied by selecting the checkbox.
  5. Click the icon for the tag to modify or delete, and edit or delete the tag in Edit event operation time tag.
  Caution

  Deleting a tag removes the tag for all users to whom it has been applied. However, tags in use by event rules cannot be deleted.

• Event notification tags: If notification tags are set for an event, notifications are sent to project members with those tags. If no recipient tags are set, notifications are sent to all users in the project.

  1. Click + Add tag or +.
  2. Click + Create new tag at the bottom of the Event notification tags window.
  3. In the Create tag window, enter the tag name, select a color, and click the [ Create tag ] button to create the tag.
  4. Edit or delete created tags by clicking the icon in the tag list.
  5. Select the desired tag from the tag list in the Event notification tags window to apply it.
  Tip

  When configuring events, you can send notifications to project members and 3rd-party plugins with the selected event notification tags. You can assign tags to project members and 3rd-party plugins respectively in Alert notifications > Event notification settings.

Simulation

You can simulate using historical data before saving the alert to check the expected number of alert occurrences.

1. After completing the alert configuration, select a time range at the bottom.

2. Click the [ Simulation ] button.

3. The chart displays data by time period and the number of alert occurrences.

   Note

   You can adjust the simulation time range to check alert occurrence patterns across different time periods. Data from the last 1–2 minutes may not be available due to index build delays.

4. When configuration is complete in the Add event rule window, click the [ Save ] button.

Create alert from Log Explorer

You can create alerts directly from Log Explorer.

1. Navigate to Log > Log Search menu.

2. Configure the category and search query.

3. Click the [ Add event ] button in the upper right of the screen.

4. The alert configuration form opens in a drawer, with the current category and search query automatically filled in.

5. Complete additional settings and click the [ Save ] button.

6. After saving, click the [ Go ] button to navigate to the alert list.

Edit/delete events

1. Go to the Composite log tab in Alert > Event Configuration.

2. Click the icon for the event to edit or delete in the log event list.

3. Modify options in the Event settings screen and click the [ Save ] button.

   a. To delete the selected event, click the [ Delete ] button in the upper right of the Event settings screen.

Event sharing

You can save metric event settings as a JSON file to share configurations with other users or import settings created by others.

• JSON file name: event-rules-YYYYMMDD.json

Export

1. Click the [ JSON ] button at the top right of the screen.
2. When the JSON editor opens, click the [ Export ] button.
   • If you use the export function after searching for events, only the searched list will be downloaded as a JSON file.
3. After the JSON file is downloaded, share it with other users.

Import

1. Click the [ ] button at the top right of the screen.
2. Select the JSON file downloaded using the Export function.
3. When the JSON editor opens, choose either [ Add to List ] or [ Overwrite ].

Caution

It is recommended to use this feature between projects of the same product type. You can import event settings from projects of different products, but they may not function correctly.

Edit in JSON Format

1. Click the [ JSON ] button at the top right of the screen.

2. When the editor opens, modify the content according to the JSON format.

3. After completing the edits, click the [ Save ] button at the bottom of the screen.

Note

If the modified content does not conform to the JSON format, an error message will be displayed at the bottom of the screen and the content cannot be saved. The error message may vary depending on the type of formatting issue.