Anatomy of an alert
Two records back this:- AlertRule — the user-defined rule. Metric, operator, threshold, cooldown, notification channel.
- AlertEvent — one occurrence of a rule firing. Carries acknowledged-at and resolved-at timestamps.
Supported metrics
Operators
Pick the comparison that matches the metric:Creating a rule
1
Open Alerts → Rules
Click Add rule.
2
Pick a metric and threshold
For example,
p95_latency > 8 seconds.3
Set the cooldown
Default 15 minutes. The same rule won’t fire again inside the cooldown window even if the metric stays breached. This is what prevents flapping.
4
Choose the destination
Email, webhook, or both. The webhook payload mirrors the
AlertEvent shape.5
Save and test
Use the Evaluate now button on the rule row to fire a one-shot evaluation against current data, without touching the cooldown.
API
SLA tracking
When an event fires, two timers start: time-to-acknowledge and time-to-resolve. The Alerts page shows current values and historical compliance against the SLA targets you set per rule. Use this to:- Prove operational readiness to auditors
- Spot rules that fire too often (noise) or never get acknowledged (ignored)
Related resources
Drift Monitor
The source of the
drift_composite metric.Audit Trail
Every ack and resolve is captured in the audit log.