observe_alerts_create

Tool

observe_alerts_create

Create an alert rule for this product.

Create an alert rule for this product. error_rate counts error events in the window; log_match counts log lines matching a Lucene expression, the same one observe_logs_search takes. The rule fires when the count reaches the threshold and resolves when it drops back below it; throttleMinutes is how long it stays quiet after firing. An expression that cannot be parsed is rejected here rather than failing silently on every evaluation.

Behavior

HTTP: POST /observe/alerts

Arguments

Name	Type	Required	Description
kind	string	•	error_rate counts error events in the window; log_match counts log lines matching q
name	string	•	What to call the rule, up to 200 characters
enabled	boolean	—	false registers the rule without evaluating it
condition	object	•	The kind’s parameters
throttleMinutes	integer	—	How long after firing the rule stays quiet. Default 60, up to a week

Response

Field	Type	Always	Description
id	string	•	Identifier of the rule
kind	string	•	What the rule measures
name	string	•	Human name the rule was registered under
state	string	•	firing means the condition is met right now
enabled	boolean	•	Whether the evaluator measures it every minute
condition	object	•	The kind’s parameters: threshold and window, plus q for log_match
createdAt	string	•	ISO 8601 creation timestamp
updatedAt	string	•	ISO 8601 timestamp of the last change
lastFiredAt	string	•	ISO 8601 time it last fired, or null
throttleMinutes	number	•	How long after firing the rule stays quiet

Try it

Create an alert rule for this product.

When to use

Example

Ask your agent something like this:

Create an alert rule for this product.

The agent will invoke observe_alerts_create with these arguments:

{
  "kind": "<kind>",
  "name": "<name>",
  "condition": "<condition>"
}