Docs

Torch Log Service

Alarm

Trigger alerts based on log keywords

Analyzing and monitoring log data is essential for the timely detection of anomalies. Among these, keyword-triggered alerts are a common alerting method for monitoring. For example, an alert can be triggered when a target keyword appears in logs or when its occurrence exceeds expectations, helping responsible personnel promptly detect important events or anomalies.

Case 1: Trigger an alert as soon as a keyword appears

An alert is triggered when the target keyword appears in the log within the specified time range. Refer to the following example to create an alarm policy that triggers an alarm when the log contains "error".

Alarm policy

Important configuration examples are as follows. For detailed operational steps and parameter descriptions, please refer to Create alarm policy.

Execute statement

Set the query time range to the past minute, and use the following query and analysis statement to count the number of times error occurs within one minute. A count value greater than 0 indicates that there is an error in the log.

error | SELECT COUNT(*) AS count

Trigger conditions

An alert is triggered when the count value is greater than 0. The conditional expression is as follows:

$1.count >0

Alert notification

[$1.count=2] indicates that the error keyword appeared twice within the specified time range, therefore triggering an alert.

Case 2: Trigger an alert based on the number of keyword occurrences

An alert is triggered when the number of occurrences of the target keyword in the logs exceeds the specified threshold within the designated time range. For example, create an alarm policy as shown below that triggers an alarm when the number of errors exceeds 10 within one hour.

Alarm policy

Important configuration examples are as follows. For detailed operating procedures and parameter descriptions, refer to Create an alarm policy.

Execute statement

Set the query time range to the past hour, and use the following query statement to calculate the number of error occurrences during that hour.

error | SELECT COUNT(*) AS count

Trigger conditions

An alert is triggered when the count value is greater than 10. The conditional expression is as follows:

$1.count >10

Alert notification

[$1.count=23] indicates that the 'error' keyword appeared 23 times within the specified time range, exceeding the expected 10 occurrences and therefore triggering an alert.

Case 3: Trigger an alert based on year-on-year growth rate in the number of keyword occurrences

When the occurrence of log keywords exhibits periodic variation, such as a significantly higher probability in the morning, it is recommended to compare the number of keyword occurrences within the same time period across different dates and trigger alerts based on the growth rate compared to the same period on previous days.

Alarm policy

Important configuration examples are as follows. For detailed operating procedures and parameter descriptions, refer to create alarm policy.

Execute statement

Set the query time range to the past hour, and calculate the year-over-year growth rate using the following query statement. Specifically, today indicates the number of times the error keyword appears in the most recent hour today. yesterday indicates the number of times the error keyword appears during the same period yesterday. ratio indicates the growth rate in the number of error keyword occurrences during the specified time period today compared to the same period yesterday.

tip

Only the TLS 2.0 architecture supports the COMPARE function. For more details, see Year-over-year and month-over-month functions.

error | SELECT
diff [1] AS today,
diff [2] AS yesterday,
(diff [3]-1) * 100 AS ratio
FROM (
SELECT
COMPARE(cnt, 86400) AS diff
FROM (
SELECT
COUNT(*) AS cnt
)
)

Trigger conditions

When the ratio value is greater than 10, an alert is triggered. The conditional expression is as follows:

$1.ratio >10

Alert notification

[$1.ratio=23.11376372461298] indicates that the number of occurrences of the error keyword during the specified time period today increased by 23.11...% compared to the same period yesterday, exceeding the expected 10%, and therefore triggered an alert.

Last updated: 2026.09.07 16:36:56