Real-time Log Events

Home > Select Project > Alert > Event Configuration > Real-time Log tab

You can set alert notifications by filtering collected log data against conditions. Log monitoring must be activated to use log events. For more information on activating log monitoring, refer to the log documentation for each product.

• Real-time log event: An event is triggered when the configured event conditions are met in real-time collected logs.

Default options

• Search: Search for events by selecting an event name or event notification tag

• JSON download/upload: Event rules can be directly edited through the JSON editor, or downloaded as a file, modified, and re-uploaded

• Notification message settings: Select detailed items for the message to receive and edit the content for each item

• + Add event: Add a new log event

  Table | Real-time log event list configuration

  Item	Description
  Event name	Event name used as the notification title - Up to 255 bytes
  Category	Log classification name (log folder name)
  Search key	The field to search for in log data - Example: To access an HTTP response status code, use the search key status
  Search value	The actual value corresponding to the search key. An alert is sent when logs contain the specified value - Example: If the search key is status and the search value is 200, an alert is triggered when logs containing HTTP status code 200 are collected
  Pause event notifications	Pauses the same event notification for a specified time after an event notification is triggered - Available times: Disabled, 5 min, 10 min, 15 min, 20 min, 30 min, 1 hour, 2 hours, 3 hours, 6 hours, 12 hours, 1 day - If resolved notifications are enabled, no notification is sent for the same event during the selected time after receiving a normal (RECOVERED) status notification
  Event target filtering	Conditions that define the targets to which the event applies - If no condition is set, alerts are evaluated for all collected data - Select input: Build conditions by selecting tags, operators, and values - Direct input: Manually enter conditions to specify targets
  Event notification tags	User or group (notification tag) to receive the event notification
  	Edit and delete events
  	Whether the event is active - Enabled: Event occurs when conditions are met - Disabled: Event does not operate and conditions are not checked

Event settings

Log events allow you to configure alert notifications when logs are collected in real time or when logs that meet specific conditions accumulate.

Add real-time log event

1. Click the Real-time Log tab in Alert > Event Configuration.

2. Click the [ + Add event ] button on the right side of the screen.

3. Set the log event conditions in the Add event rule window.

   • Event name: Enter a name to use as the event title.

   • Event activation: When the toggle button is activated, an event occurs when conditions are met.

   • Level: Select the event level (Critical, Warning, Info).

   • Message: Enter the notification message to receive when the event is triggered. You can use variables in the message to include actual values at the time of event occurrence.

     Tip

     Variable usage rules

     • Variable format: ${metricName}
     • Only metrics within the same category as the configured category can be used as variables.
     • You can combine multiple variables to compose a detailed message.
     • A list of available variables can be checked in Metrics Query.

   • Category: Select the log classification name (log folder name) from the list or enter it directly. You must select a category before entering a search key and search value.

   • Search key: Enter the field you want to search for in log data.

     • Example: To access an HTTP response status code, use the search key status.

   • Search value: Enter the actual value corresponding to the search key. An alert is sent when logs contain the specified value.

     • Example: If the search key is status and the search value is 200, an alert is triggered when logs containing HTTP status code 200 are collected.

   • Event target filtering: Enter conditions to define the targets to which the event applies. If no value is entered, alerts are evaluated for all collected data.

     • Select input: Select a tag, operator, and value to set the target conditions.

       Note

       For condition expression syntax and supported operators, refer to the Condition settings guide.

     • Direct input: Enter conditions directly.

   • Pause event notifications: Select a duration to temporarily suppress alerts. After the event is triggered, the same event will not occur during the selected time.

     • Available times: Disabled, 1 min, 2 min, 3 min, 5 min, 10 min, 20 min, 30 min, 1 hour, 3 hours, 6 hours, 12 hours

   • Event operation time: Set tags to activate the event during specific time periods (work/non-work/maintenance hours, etc.). If no tag is set, the event operates 24 hours a day when activated.

     1. Click + Add.
     2. Click + Create new tag in Event operation time.
     3. In Create event operation time tag, select the tag name, day of week, time, and color, then click the [ Apply ] button.
     4. Created tags can be viewed in the tag list and are applied by selecting the checkbox.
     5. Click the icon for the tag to modify or delete, and edit or delete the tag in Edit event operation time tag.
     Caution

     Deleting a tag removes the tag for all users to whom it has been applied. However, tags in use by event rules cannot be deleted.

   • Event notification tags: If notification tags are set for an event, notifications are sent to project members with those tags. If no recipient tags are set, notifications are sent to all users in the project.

     1. Click + Add tag or +.
     2. Click + Create new tag at the bottom of the Event notification tags window.
     3. In the Create tag window, enter the tag name, select a color, and click the [ Create tag ] button to create the tag.
     4. Edit or delete created tags by clicking the icon in the tag list.
     5. Select the desired tag from the tag list in the Event notification tags window to apply it.
     Tip

     When configuring events, you can send notifications to project members and 3rd-party plugins with the selected event notification tags. You can assign tags to project members and 3rd-party plugins respectively in Alert notifications > Event notification settings.

4. When configuration is complete in the Add event rule window, click the [ Save ] button.

Edit/delete events

1. Go to the Real-time log tab in Alert > Event Configuration.

2. Click the icon for the event to edit or delete in the log event list.

3. Modify options in the Event settings screen and click the [ Save ] button.

   a. To delete the selected event, click the [ Delete ] button in the upper right of the Event settings screen.

Event sharing

You can save metric event settings as a JSON file to share configurations with other users or import settings created by others.

• JSON file name: event-rules-YYYYMMDD.json

Export

1. Click the [ JSON ] button at the top right of the screen.
2. When the JSON editor opens, click the [ Export ] button.
   • If you use the export function after searching for events, only the searched list will be downloaded as a JSON file.
3. After the JSON file is downloaded, share it with other users.

Import

1. Click the [ ] button at the top right of the screen.
2. Select the JSON file downloaded using the Export function.
3. When the JSON editor opens, choose either [ Add to List ] or [ Overwrite ].

Caution

It is recommended to use this feature between projects of the same product type. You can import event settings from projects of different products, but they may not function correctly.

Edit in JSON Format

1. Click the [ JSON ] button at the top right of the screen.

2. When the editor opens, modify the content according to the JSON format.

3. After completing the edits, click the [ Save ] button at the bottom of the screen.

Note

If the modified content does not conform to the JSON format, an error message will be displayed at the bottom of the screen and the content cannot be saved. The error message may vary depending on the type of formatting issue.

---

Appendix

Trigger Conditions and Target Selection Guide

Metric alert trigger conditions and event target selection use the same syntax. However, trigger conditions use the field key as the variable, while target selection uses the tag key as the variable.

Level Behavior Guide

Event levels are categorized into Critical, Warning, and Info.

1. Priority-based Event Triggering

   When multiple level conditions are met at the same time, only the event with the highest priority is triggered.

   Example

   Configuration:
   - Warning: CPU > 70%
   - Critical: CPU > 90%
   
   Current state: CPU 95%
   → Result: Only the Critical event is triggered (Warning is suppressed)

2. Level Escalation

   For events that maintain an in-progress state, when a higher-level condition is met while a lower-level event is already in progress, both levels enter the in-progress state.

   Example

   Configuration:
   - Warning: CPU > 70%
   - Critical: CPU > 90%
   
   Scenario:
   1) CPU 80% → Warning triggered (in progress)
   2) CPU 95% → Warning (in progress), Critical (in progress)

3. Level De-escalation

   For events with an in-progress state, when the level transitions from a higher level to a lower level, the higher-level event is resolved while the lower-level event remains active.

   Example

   Configuration:
   - Warning: CPU > 70%
   - Critical: CPU > 90%
   
   Scenario:
   1) CPU 97% → Critical triggered
   2) CPU 85% → Critical resolved, Warning remains
   3) CPU 65% → Warning resolved

4. Execution Flow

   - Warning: CPU > 70%
   - Critical: CPU > 90%
   
   Metric value: 60%   →    75%    →    92%    →    85%    →    60%
   State:        Info        Warning      Critical       Warning       Info
                              (triggered)   (triggered)     (maintained)   (resolved)
                                              Warning
                                                 (maintained)

Note

Events that have an in-progress state remain active as long as their conditions are met and continue until those conditions are cleared.

Condition Configuration Guide

Caution

If a metric name starts with a number or contains special characters, you must wrap it in the ${metric_name} format.

• Brackets ( ), [ ]
• Operators +, -, *, /, %
• Delimiters :, @, #, ,, (space)
• Other special characters !, ^, &, |, ~, ```, =

Examples using ${}:

${cpu(xos)} > 50
${mem[0]} >= 100
${cpu-usage} > 80
${namespace:cpu} > 70
${metric name} > 60
${4xx_error} > 10

Usable without ${}: Metric names that contain only alphabetic characters, underscores (_), or dots (.)

cpu > 80
cpu_usage > 50
CPUUtilization.Average > 0.8

1. Comparison Operators

   Numeric Comparison

       Greater than:            cpu > 80
       Greater than or equal:   cpu >= 80
       Less than:               memory < 1000
       Less than or equal:      memory <= 1000
       Equal to:                status == 200
       Not equal to:            error != 0

   String Comparison

       status == 'OK'
       region == "us-east-1"

2. Arithmetic Operators

   • Basic arithmetic operations

     Addition:        cpu + 10 >= 90
     Subtraction:     memory - 100 >= 500
     Multiplication: cpu * 2 >= 100
     Division:       disk / 1024 >= 100
     Modulo:         value % 10 == 0

   • Controlling precedence with parentheses

     (cpu + memory) * 2 >= 200
     (disk - used) / total >= 0.2
     ((cpu + memory) / 2) >= 50

   • Negative values

     cpu > -100

3. Logical Operators

   • AND operator (&&)

     cpu > 80 && memory > 1000
     ${cpu(xos)} > 50 && ${mem(xos)} > 60

   • OR operator (||)

     cpu > 90 || memory > 90
     disk < 10 || network > 1000

   • Combined logical operations

     (cpu > 50 && memory > 50) || disk < 20
     cpu > 80 && (memory > 1000 || disk > 500)

4. Pattern Matching Operators

   • LIKE operator

     oname like 'prod-*'
     url like '*error*'
     message like 'WARN%'

   • NOT LIKE operator

     oname not like 'test-*'
     url not like '*debug*'

5. Built-in Functions

   • Null check functions

     isNull(value)             # Checks whether the value is null
     isNotNull(value)          # Checks whether the value is not null
     nvl(value, 0)             # Returns a default value if null
     isEmpty(str)              # Checks whether the string is empty
     isNotEmpty(str)           # Checks whether the string is not empty

   • Aggregate functions

     sum(cpu, memory, disk)              # Sum
     avg(cpu, memory)                    # Average
     max(cpu, memory, disk)              # Maximum
     min(cpu, memory, disk)              # Minimum
     count(value1, value2, value3)       # Count

   • Math functions

     round(cpu, 2)             # Rounds to 2 decimal places

   • String functions

     length(str)                # String length
     startsWith(str, 'prefix')  # Checks prefix
     endsWith(str, 'suffix')    # Checks suffix
     indexOf(str, 'search')     # String index
     substring(str, 0, 10)      # Substring
     trim(str)                  # Trims whitespace
     replace(str, 'old', 'new') # String replacement
     hasStr(str, 'search')      # Checks string containment

   • Conditional functions

     • if: A conditional function that returns the trueValue if the condition evaluates to true, or the falseValue if it evaluates to false
     Syntax

     if(condition, trueValue, falseValue)

     Example

     if(value >= 90, 'High', 'Medium') == 'High'

     • decode: Compares a value against conditions and returns the result of the matching condition, or a default value if no match is found
     Syntax

     decode(value, condition1, result1, condition2, result2, ..., conditionN, resultN, defaultValue)

     Example

     decode(value, 1, 'Low', 2, 'Medium', 3, 'High', 'Unknown') == 'Unknown'

     • in: Returns true if the value matches any of the specified candidates; otherwise returns false
     Syntax

     in(value, candidate1, candidate2, ..., candidateN)

     Example

     in(status, 200, 201, 204) == false

   Caution

   Writing Guidelines

   • Recommended

     • Use simple variable names without ${} (e.g. cpu, memory)
     • Always use ${} when special characters are included
     • Use parentheses to clearly separate complex expressions
     • Enter function names exactly as defined (case-sensitive)

   • Avoid

     • Incomplete expressions (e.g. cpu >, memory &&)
     • Mismatched parentheses (e.g. (cpu > 80 && cpu > 70))
     • Consecutive or invalid operators (e.g. cpu >> 80, cpu >< 80)