Docs

Torch Log Service

Alarm

Quickly configure log alarm

This topic describes how to create content templates, set up Webhook integration, create notification groups, set alarm policies (including sending raw logs in alarm notifications), and view alarm records. These steps help you quickly get started with log alarm features in TLS.

Background information

TLS provides a one-stop alarm function for real-time monitoring and rapid response to alarm events. This example configures an alarm policy based on website error logs. That is to say, a dedicated log topic is created to store website error logs. In alarm policy, the * | SELECT COUNT(*) AS total statement is employed on counting the number of error logs. If the log topic contains more than 0 logs, it indicates an error has occurred and triggers the alarm condition $1.total>0. The alarm notification is then sent to the Lark bot immediately.

Prerequisites

The website error logs have been collected in TLS. For detailed steps, see Collection overview.

A Lark bot has been created. For detailed steps, see Custom bot user guide.

Step 1 Create a content template

A content template is a predefined text template. TLS sends alert notifications to designated notification channels based on the content defined in the template. TLS provides a default template for your convenience. This example creates a custom content template based on the default template.

Select the region where log service is located from the top navigation bar.

On the left navigation bar, select Common features > Log alarm > Notification management.

On the Notification management page, under the Alarm template tab, click Create alarm template.

Configure the content template settings.

Name the template, for example, Lark content template.

Set the notification content in the Lark section.

For detailed parameter descriptions, see Create content template.

Configuration	Description	Example
Title	The subject of the alarm notification.	TLS alarm
Body	Alarm notification content. Supports inserting content variables, content functions, and more. For detailed instructions, see Content variable and Content functions.	Dear user, hello！\nYour account(Main accountID：{{AccountID}} ）'s log service{%if NotifyType==1%}triggered an alarm{%else%}Alarm recovery{%endif%}\nAlarm policy: {{Alarm}}\nAlarm log topic：{{AlarmTopicName}}\nTriggering time：{{StartTime}}\nTriggering condition：{{Condition}}\nCurrent query result：[{%-for x in TriggerParams-%}{{-x-}} {%-endfor-%}];\nLogin-free link：{{SignInUrl\|safe}}\nNotification content：{{NotifyMsg\|escapejs}}\n\nThanks for your support for Volcanoengine. Notice The NotifyMsg variable will reference the notification content in the alarm policy.

Step 2 Create a Webhook integration configuration

The Webhook integration configuration manages the Lark bot Webhook address.

On the notification management page, click the webhook integration tab, and then click Create webhook integration.

In the Create Webhook integration configuration dialog box, complete the following settings and click Create.

For detailed parameter descriptions, see Create Webhook integration configuration.

Configuration	Description	Example
Name	Name for Webhook integration configuration.	Lark webhook
Type	Notification channel type. This example uses Lark.	Lark
Request URL	Webhook address for Lark bot. For instructions, see Custom bot user guide.	https://open.feishu.cn/open-apis/bot/v2/hook/b6****0c
Encryption key	Webhook encryption key. Optional. When the security settings for the Lark bot are set to signature verification, enter the bot's signature key here.	/

Step 3 Create a notification group

Notification groups manage action policy and notification recipients for alarm notifications.

On the notification management page, select the notification group tab, and then click Create notification group.

On the Create notification group page, complete the following configurations and click Create notification group.

For detailed parameter descriptions, see Create notification group.

Step 4 Create an alarm policy

In alarm policy, configurations like basic information, monitoring task, and alarm notification are required. TLS periodically analyzes logs based on the alarm policy and sends alarms that meet the trigger conditions to the specified notification recipients on a regular basis.

In the left navigation panel, select Common features > Log alarm > Alarm policy.

On the Alarm policy page, click Create alarm policy.

On the Create alarm policy page, complete the following configuration.

For detailed parameter descriptions, see Create alarm policy.

Fill in the Basic information for the alarm policy.

Configuration
Description
Example
Alarm policy name
Name of the alarm policy.
Error log alarm
Log project
The project where the log topic to be monitored is located.
test**

Configure Monitoring task.

Configuration	Description	Example
Monitoring interval	The monitoring interval for the monitoring task.	Run the monitoring task every 10 minutes
Execute task	The relevant configuration information for monitoring task. The system executes the monitoring task periodically based on this configuration. Click Edit. In the Execute statement dialog box, complete the following configuration. Monitoring topics: The log topic to be monitored. Query statement: The query and analysis statement. Each task will regularly perform query and analysis using this statement. For details on query and analysis statements, see Query overview and Analysis overview. Query time range: The time range of the data when each query and analysis statement is executed. You can specify any period within the 1 day before the task execution time. Click Execution preview to view the query and analysis results for the specified time range. Click Reset.	Monitored object: test** Query statement: * \| SELECT COUNT(*) AS total Query time range: last 15 minutes
Trigger condition	TLS determines whether the query and analysis result set meets the trigger condition. Trigger condition: Have data: If there is data in the query and analysis results, an alarm is triggered. There are specific pieces of data: When there are N entries in the query and analysis results, an alarm is triggered. There is a data match: An alert is triggered when data in the query and analysis results meets the condition expression. There is a specific data match: An alert is triggered when N records in the query and analysis results meet the alert expression. Alert level: Set the alert level as notification, warning, or critical.	Data matching, $1.total>0, Notification
NoData alarm	After enabling this feature, an independent NoData alarm is triggered when the result of a set operation is an empty set.	Disable
Alarm recovery	Send the corresponding recovery notification when alarm recovery is triggered after enabling this feature.	Enable

Configure Alarm notice.

Configuration	Description	Example
Alarm sending frequency	The frequency of alert notifications. When the number of consecutive alert triggers reaches the specified limit, TLS sends alert notifications based on the defined interval.	If the trigger condition is met for one full monitoring interval, set the alert sending cycle to 30 minutes per alert.
Notification group	Select the notification group you created in Step 3 Create a notification group.	Lark notification group
Additional notification content	For alert notification content, you can directly click Insert variable to reference content variables. For supported variables, see Content variable. The content entered here will only be shown in the sent alert when referenced by the NotifyMsg variable in the Content template via Step 1 Create a content template. Notice The default Content template has the NotifyMsg variable pre-added. If you use a custom content template, ensure that the NotifyMsg variable has been added. If the original log is too long or contains special characters, causing the alarm to fail to send, you can add the escapejs filter for unicode encoding. For details, see QueryLog variable.	Click the link {{DetailUrl}} to view execution history. Original log: {{toJson(QueryLog)}}

Click Test alarm policy.

To make it easier to troubleshoot problems in abnormal scenarios and preview alarm notification results in advance, we recommend that you debug using the alarm testing feature when creating an alarm policy. For detailed information about the alarm testing feature, see Alarm policy testing.

Click Create alarm policy.

After creating an alarm policy, the policy is enabled by default. TLS will continue to run monitoring tasks and send alarm notifications based on the alarm policy.

Step 5 View alarm records

After the alarm policy takes effect, monitoring tasks will run periodically and record the result of each execution.

In the left navigation bar, select Common features > Log alarm > Alarm history.

View alarm records on the Alarm history page.

For more details, see View execution details.

Last updated: 2026.04.23 18:32:14