REST Resource: projects.alertPolicies

string

Identifier. Required if the policy exists. The resource name for this policy. The format is:

projects/[PROJECT_ID_OR_NUMBER]/alertPolicies/[ALERT_POLICY_ID]

[ALERT_POLICY_ID] is assigned by Cloud Monitoring when the policy is created. When calling the alertPolicies.create method, do not include the name field in the alerting policy passed as part of the request.

string

A short name or phrase used to identify the policy in dashboards, notifications, and incidents. To avoid confusion, don't use the same display name for multiple policies in the same project. The name is limited to 512 Unicode characters.

The convention for the displayName of a PrometheusQueryLanguageCondition is "{rule group name}/{alert name}", where the {rule group name} and {alert name} should be taken from the corresponding Prometheus configuration file. This convention is not enforced. In any case the displayName is not a unique key of the AlertPolicy.

object (Documentation)

Documentation that is included with notifications and incidents related to this policy. Best practice is for the documentation to include information to help responders understand, mitigate, escalate, and correct the underlying problems detected by the alerting policy. Notification channels that have limited capacity might not show this documentation.

map (key: string, value: string)

User-supplied key/value data to be used for organizing and identifying the AlertPolicy objects.

The field can contain up to 64 entries. Each key and value is limited to 63 Unicode characters or 128 bytes, whichever is smaller. Labels and values can contain only lowercase letters, numerals, underscores, and dashes. Keys must begin with a letter.

Note that Prometheus {alert name} is a valid Prometheus label names, whereas Prometheus {rule group} is an unrestricted UTF-8 string. This means that they cannot be stored as-is in user labels, because they may contain characters that are not allowed in user-label values.

object (Condition)

A list of conditions for the policy. The conditions are combined by AND or OR according to the combiner field. If the combined conditions evaluate to true, then an incident is created. A policy can have from one to six conditions. If conditionTimeSeriesQueryLanguage is present, it must be the only condition. If conditionMonitoringQueryLanguage is present, it must be the only condition.

enum (ConditionCombinerType)

How to combine the results of multiple conditions to determine if an incident should be opened. If conditionTimeSeriesQueryLanguage is present, this must be COMBINE_UNSPECIFIED.

boolean

Whether or not the policy is enabled. On write, the default interpretation if unset is that the policy is enabled. On read, clients should not make any assumption about the state if it has not been populated. The field should always be populated on List and Get operations, unless a field projection has been specified that strips it out.

object (Status)

Read-only description of how the alerting policy is invalid. This field is only set when the alerting policy is invalid. An invalid alerting policy will not generate incidents.

string

Identifies the notification channels to which notifications should be sent when incidents are opened or closed or when new violations occur on an already opened incident. Each element of this array corresponds to the name field in each of the NotificationChannel objects that are returned from the notificationChannels.list method. The format of the entries in this field is:

projects/[PROJECT_ID_OR_NUMBER]/notificationChannels/[CHANNEL_ID]

object (MutationRecord)

A read-only record of the creation of the alerting policy. If provided in a call to create or update, this field will be ignored.

object (MutationRecord)

A read-only record of the most recent change to the alerting policy. If provided in a call to create or update, this field will be ignored.

object (AlertStrategy)

Control over how this alerting policy's notification channels are notified.

enum (Severity)

Optional. The severity of an alerting policy indicates how important incidents generated by that policy are. The severity level will be displayed on the Incident detail page and in notifications.

string

The body of the documentation, interpreted according to mimeType. The content may not exceed 8,192 Unicode characters and may not exceed more than 10,240 bytes when encoded in UTF-8 format, whichever is smaller. This text can be templatized by using variables.

string

The format of the content field. Presently, only the value "text/markdown" is supported. See Markdown for more information.

string

Optional. The subject line of the notification. The subject line may not exceed 10,240 bytes. In notifications generated by this policy, the contents of the subject line after variable expansion will be truncated to 255 bytes or shorter at the latest UTF-8 character boundary. The 255-byte limit is recommended by this thread. It is both the limit imposed by some third-party ticketing products and it is common to define textual fields in databases as VARCHAR(255).

The contents of the subject line can be templatized by using variables. If this field is missing or empty, a default subject line will be generated.

object (Link)

Optional. Links to content such as playbooks, repositories, and other resources. This field can contain up to 3 entries.

string

A short display name for the link. The display name must not be empty or exceed 63 characters. Example: "playbook".

string

The url of a webpage. A url can be templatized by using variables in the path or the query parameters. The total length of a URL should not exceed 2083 characters before and after variable expansion. Example: "https://my_domain.com/playbook?name=${resource.name}"

string

Required if the condition exists. The unique resource name for this condition. Its format is:

projects/[PROJECT_ID_OR_NUMBER]/alertPolicies/[POLICY_ID]/conditions/[CONDITION_ID]

[CONDITION_ID] is assigned by Cloud Monitoring when the condition is created as part of a new or updated alerting policy.

When calling the alertPolicies.create method, do not include the name field in the conditions of the requested alerting policy. Cloud Monitoring creates the condition identifiers and includes them in the new policy.

When calling the alertPolicies.update method to update a policy, including a condition name causes the existing condition to be updated. Conditions without names are added to the updated policy. Existing conditions are deleted if they are not updated.

Best practice is to preserve [CONDITION_ID] if you make only small changes, such as those to condition thresholds, durations, or trigger values. Otherwise, treat the change as a new condition and let the existing condition be deleted.

string

A short name or phrase used to identify the condition in dashboards, notifications, and incidents. To avoid confusion, don't use the same display name for multiple conditions in the same policy.

object (MetricThreshold)

A condition that compares a time series against a threshold.

object (MetricAbsence)

A condition that checks that a time series continues to receive new data points.

object (LogMatch)

A condition that checks for log messages matching given constraints. If set, no other conditions can be present.

object (MonitoringQueryLanguageCondition)

A condition that uses the Monitoring Query Language to define alerts.

object (PrometheusQueryLanguageCondition)

A condition that uses the Prometheus query language to define alerts.

object (SqlCondition)

A condition that periodically evaluates a SQL query result.

string

Required. A filter that identifies which time series should be compared with the threshold.

The filter is similar to the one that is specified in the timeSeries.list request (that call is useful to verify the time series that will be retrieved / processed). The filter must specify the metric type and the resource type. Optionally, it can specify resource labels and metric labels. This field must not exceed 2048 Unicode characters in length.

object (Aggregation)

Specifies the alignment of data points in individual time series as well as how to combine the retrieved time series together (such as when aggregating multiple streams on each resource to a single stream for each resource or when aggregating streams across all members of a group of resources). Multiple aggregations are applied in the order specified.

This field is similar to the one in the timeSeries.list request. It is advisable to use the timeSeries.list method when debugging this field.

string

A filter that identifies a time series that should be used as the denominator of a ratio that will be compared with the threshold. If a denominatorFilter is specified, the time series specified by the filter field will be used as the numerator.

The filter must specify the metric type and optionally may contain restrictions on resource type, resource labels, and metric labels. This field may not exceed 2048 Unicode characters in length.

object (Aggregation)

Specifies the alignment of data points in individual time series selected by denominatorFilter as well as how to combine the retrieved time series together (such as when aggregating multiple streams on each resource to a single stream for each resource or when aggregating streams across all members of a group of resources).

When computing ratios, the aggregations and denominatorAggregations fields must use the same alignment period and produce time series that have the same periodicity and labels.

object (ForecastOptions)

When this field is present, the MetricThreshold condition forecasts whether the time series is predicted to violate the threshold within the forecastHorizon. When this field is not set, the MetricThreshold tests the current value of the timeseries against the threshold.

enum (ComparisonType)

The comparison to apply between the time series (indicated by filter and aggregation) and the threshold (indicated by thresholdValue). The comparison is applied on each time series, with the time series on the left-hand side and the threshold on the right-hand side.

Only COMPARISON_LT and COMPARISON_GT are supported currently.

number

A value against which to compare the time series.

string (Duration format)

The amount of time that a time series must violate the threshold to be considered failing. Currently, only values that are a multiple of a minute--e.g., 0, 60, 120, or 300 seconds--are supported. If an invalid value is given, an error will be returned. When choosing a duration, it is useful to keep in mind the frequency of the underlying time series data (which may also be affected by any alignments specified in the aggregations field); a good duration is long enough so that a single outlier does not generate spurious alerts, but short enough that unhealthy states are detected and alerted on quickly.

object (Trigger)

The number/percent of time series for which the comparison must hold in order for the condition to trigger. If unspecified, then the condition will trigger if the comparison is true for any of the time series that have been identified by filter and aggregations, or by the ratio, if denominatorFilter and denominatorAggregations are specified.

enum (EvaluationMissingData)

A condition control that determines how metric-threshold conditions are evaluated when data stops arriving. To use this control, the value of the duration field must be greater than or equal to 60 seconds.

string (Duration format)

The alignmentPeriod specifies a time interval, in seconds, that is used to divide the data in all the time series into consistent blocks of time. This will be done before the per-series aligner can be applied to the data.

The value must be at least 60 seconds. If a per-series aligner other than ALIGN_NONE is specified, this field is required or an error is returned. If no per-series aligner is specified, or the aligner ALIGN_NONE is specified, then this field is ignored.

The maximum value of the alignmentPeriod is 104 weeks (2 years) for charts, and 90,000 seconds (25 hours) for alerting policies.

enum (Aligner)

An Aligner describes how to bring the data points in a single time series into temporal alignment. Except for ALIGN_NONE, all alignments cause all the data points in an alignmentPeriod to be mathematically grouped together, resulting in a single data point for each alignmentPeriod with end timestamp at the end of the period.

Not all alignment operations may be applied to all time series. The valid choices depend on the metricKind and valueType of the original time series. Alignment can change the metricKind or the valueType of the time series.

Time series data must be aligned in order to perform cross-time series reduction. If crossSeriesReducer is specified, then perSeriesAligner must be specified and not equal to ALIGN_NONE and alignmentPeriod must be specified; otherwise, an error is returned.

enum (Reducer)

The reduction operation to be used to combine time series into a single time series, where the value of each data point in the resulting series is a function of all the already aligned values in the input time series.

Not all reducer operations can be applied to all time series. The valid choices depend on the metricKind and the valueType of the original time series. Reduction can yield a time series with a different metricKind or valueType than the input time series.

Time series data must first be aligned (see perSeriesAligner) in order to perform cross-time series reduction. If crossSeriesReducer is specified, then perSeriesAligner must be specified, and must not be ALIGN_NONE. An alignmentPeriod must also be specified; otherwise, an error is returned.

string

The set of fields to preserve when crossSeriesReducer is specified. The groupByFields determine how the time series are partitioned into subsets prior to applying the aggregation operation. Each subset contains time series that have the same value for each of the grouping fields. Each individual time series is a member of exactly one subset. The crossSeriesReducer is applied to each subset of time series. It is not possible to reduce across different resource types, so this field implicitly contains resource.type. Fields not specified in groupByFields are aggregated away. If groupByFields is not specified and all the time series have the same resource type, then the time series are aggregated into a single output time series. If crossSeriesReducer is not defined, this field is ignored.

string (Duration format)

Required. The length of time into the future to forecast whether a time series will violate the threshold. If the predicted value is found to violate the threshold, and the violation is observed in all forecasts made for the configured duration, then the time series is considered to be failing. The forecast horizon can range from 1 hour to 60 hours.

integer

The absolute number of time series that must fail the predicate for the condition to be triggered.

number

The percentage of time series that must fail the predicate for the condition to be triggered.

string

Required. A filter that identifies which time series should be compared with the threshold.

The filter is similar to the one that is specified in the timeSeries.list request (that call is useful to verify the time series that will be retrieved / processed). The filter must specify the metric type and the resource type. Optionally, it can specify resource labels and metric labels. This field must not exceed 2048 Unicode characters in length.

object (Aggregation)

Specifies the alignment of data points in individual time series as well as how to combine the retrieved time series together (such as when aggregating multiple streams on each resource to a single stream for each resource or when aggregating streams across all members of a group of resources). Multiple aggregations are applied in the order specified.

This field is similar to the one in the timeSeries.list request. It is advisable to use the timeSeries.list method when debugging this field.

string (Duration format)

The amount of time that a time series must fail to report new data to be considered failing. The minimum value of this field is 120 seconds. Larger values that are a multiple of a minute--for example, 240 or 300 seconds--are supported. If an invalid value is given, an error will be returned. The Duration.nanos field is ignored.

object (Trigger)

The number/percent of time series for which the comparison must hold in order for the condition to trigger. If unspecified, then the condition will trigger if the comparison is true for any of the time series that have been identified by filter and aggregations.

string

Required. A logs-based filter. See Advanced Logs Queries for how this filter should be constructed.

map (key: string, value: string)

Optional. A map from a label key to an extractor expression, which is used to extract the value for this label key. Each entry in this map is a specification for how data should be extracted from log entries that match filter. Each combination of extracted values is treated as a separate rule for the purposes of triggering notifications. Label keys and corresponding values can be used in notifications generated by this condition.

Please see the documentation on logs-based metric valueExtractors for syntax and examples.

string

Monitoring Query Language query that outputs a boolean stream.

string (Duration format)

The amount of time that a time series must violate the threshold to be considered failing. Currently, only values that are a multiple of a minute--e.g., 0, 60, 120, or 300 seconds--are supported. If an invalid value is given, an error will be returned. When choosing a duration, it is useful to keep in mind the frequency of the underlying time series data (which may also be affected by any alignments specified in the aggregations field); a good duration is long enough so that a single outlier does not generate spurious alerts, but short enough that unhealthy states are detected and alerted on quickly.

object (Trigger)

The number/percent of time series for which the comparison must hold in order for the condition to trigger. If unspecified, then the condition will trigger if the comparison is true for any of the time series that have been identified by filter and aggregations, or by the ratio, if denominatorFilter and denominatorAggregations are specified.

enum (EvaluationMissingData)

A condition control that determines how metric-threshold conditions are evaluated when data stops arriving.

string

Required. The PromQL expression to evaluate. Every evaluation cycle this expression is evaluated at the current time, and all resultant time series become pending/firing alerts. This field must not be empty.

string (Duration format)

Optional. Alerts are considered firing once their PromQL expression was evaluated to be "true" for this long. Alerts whose PromQL expression was not evaluated to be "true" for long enough are considered pending. Must be a non-negative duration or missing. This field is optional. Its default value is zero.

string (Duration format)

Optional. How often this rule should be evaluated. Must be a positive multiple of 30 seconds or missing. This field is optional. Its default value is 30 seconds. If this PrometheusQueryLanguageCondition was generated from a Prometheus alerting rule, then this value should be taken from the enclosing rule group.

map (key: string, value: string)

Optional. Labels to add to or overwrite in the PromQL query result. Label names must be valid. Label values can be templatized by using variables. The only available variable names are the names of the labels in the PromQL result, including "__name__" and "value". "labels" may be empty.

string

Optional. The rule group name of this alert in the corresponding Prometheus configuration file.

Some external tools may require this field to be populated correctly in order to refer to the original Prometheus configuration file. The rule group name and the alert name are necessary to update the relevant AlertPolicies in case the definition of the rule group changes in the future.

This field is optional. If this field is not empty, then it must contain a valid UTF-8 string. This field may not exceed 2048 Unicode characters in length.

string

Optional. The alerting rule name of this alert in the corresponding Prometheus configuration file.

Some external tools may require this field to be populated correctly in order to refer to the original Prometheus configuration file. The rule group name and the alert name are necessary to update the relevant AlertPolicies in case the definition of the rule group changes in the future.

This field is optional. If this field is not empty, then it must be a valid Prometheus label name. This field may not exceed 2048 Unicode characters in length.

boolean

Optional. Whether to disable metric existence validation for this condition.

This allows alerting policies to be defined on metrics that do not yet exist, improving advanced customer workflows such as configuring alerting policies using Terraform.

Users with the monitoring.alertPolicyViewer role are able to see the name of the non-existent metric in the alerting policy condition.

string

Required. The Log Analytics SQL query to run, as a string. The query must conform to the required shape. Specifically, the query must not try to filter the input by time. A filter will automatically be applied to filter the input so that the query receives all rows received since the last time the query was run.

For example, the following query extracts all log entries containing an HTTP request:

SELECT timestamp, logName, severity, httpRequest, resource, labels FROM my-project.global._Default._AllLogs WHERE httpRequest IS NOT NULL

object (Minutes)

Schedule the query to execute every so many minutes.

object (Hourly)

Schedule the query to execute every so many hours.

object (Daily)

Schedule the query to execute every so many days.

object (RowCountTest)

Test the row count against a threshold.

object (BooleanTest)

Test the boolean value in the indicated column.

integer

Required. Number of minutes between runs. The interval must be greater than or equal to 5 minutes and less than or equal to 1440 minutes.

integer

Required. The number of hours between runs. Must be greater than or equal to 1 hour and less than or equal to 48 hours.

integer

Optional. The number of minutes after the hour (in UTC) to run the query. Must be greater than or equal to 0 minutes and less than or equal to 59 minutes. If left unspecified, then an arbitrary offset is used.

integer

Required. The number of days between runs. Must be greater than or equal to 1 day and less than or equal to 31 days.

object (TimeOfDay)

Optional. The time of day (in UTC) at which the query should run. If left unspecified, the server picks an arbitrary time of day and runs the query at the same time each day.

integer

Hours of a day in 24 hour format. Must be greater than or equal to 0 and typically must be less than or equal to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

integer

Minutes of an hour. Must be greater than or equal to 0 and less than or equal to 59.

integer

Seconds of a minute. Must be greater than or equal to 0 and typically must be less than or equal to 59. An API may allow the value 60 if it allows leap-seconds.

integer

Fractions of seconds, in nanoseconds. Must be greater than or equal to 0 and less than or equal to 999,999,999.

enum (ComparisonType)

Required. The comparison to apply between the number of rows returned by the query and the threshold.

string (int64 format)

Required. The value against which to compare the row count.

string

Required. The name of the column containing the boolean value. If the value in a row is NULL, that row is ignored.

object (NotificationRateLimit)

Required for log-based alerting policies, i.e. policies with a LogMatch condition.

This limit is not implemented for alerting policies that do not have a LogMatch condition.

enum (NotificationPrompt)

For log-based alert policies, the notification prompts is always [OPENED]. For non log-based alert policies, the notification prompts can be [OPENED] or [OPENED, CLOSED].

string (Duration format)

If an alerting policy that was active has no data for this long, any open incidents will close

object (NotificationChannelStrategy)

Control how notifications will be sent out, on a per-channel basis.

string (Duration format)

Not more than one notification per period.

string

The full REST resource name for the notification channels that these settings apply to. Each of these correspond to the name field in one of the NotificationChannel objects referenced in the notificationChannels field of this AlertPolicy. The format is:

projects/[PROJECT_ID_OR_NUMBER]/notificationChannels/[CHANNEL_ID]

string (Duration format)

The frequency at which to send reminder notifications for open incidents.