Docs

Torch Log Service

Alarm policy

Triggering condition expression

When creating an alarm policy in TLS, you need to specify a trigger condition expression. TLS determines whether the alarm condition is met based on the result of this trigger condition expression.

When evaluating the result of the trigger condition expression, the execution result of the analysis statement in the related alarm policy is used as the input for the expression variables. If the result of the trigger condition expression is true, the alarm is triggered. For example, if the execution statement is result:error | SELECT count(*) AS ErrCount and the trigger condition expression for the alarm is $1.ErrCount>0, it means the alarm is triggered when logs with result "error" occur.

Syntax description

The syntax of the alarm trigger condition expression is $N.keyname, which supports referencing the results from query analysis.

Note:

N is the identifier number of the monitoring object, supporting up to 3 monitoring objects. For example, $1.key refers to the key field in the query with identifier 1.

keyname refers to the field name in the query and analysis results. Field names support letters, numbers, and underscores. We recommend using the AS syntax to set aliases for analysis results, for example, SELECT count(*) AS ErrCount.

When the query and analysis results return multiple values:

Determine which results to use for evaluation based on the variables in the expression. For example, if A, B, and C are three analysis statements configured, and only A and B are included in the expression as monitoring targets, then only the analysis results of A and B are used to determine the expression value.

The return results are calculated in sequence up to 1,000 times. Calculation stops when the result is true. For instance, providing that set operation is Cartesian product, the trigger condition is Have data, and the expression is $1.key1+$2.key2>100, then if analysis statements 1 and 2 return x and y results respectively, a total of x*y calculations will occur. During calculation, if the result satisfies $1.key1+$2.key2>100, an alert will be triggered. Calculation and alarm stop right after the calculation reaches 1,000 iterations.

Notice

An alert is triggered only when the expression evaluates to true. For example, provided that $1.key1+$1.key2 produces a result of 100, then: condition $1.key1+$1.key2 >100 is not triggered, but condition $1.key1+$1.key2 >=100 will be triggered.

If a field name contains special characters, enclose the referenced variable in []. The variable inside [] will be treated as a whole. For example, [$1.process-time], where process-time is treated as a single key.

Special characters include + - / * & | ^ ** % >> << > >= < <= == != =~ !~ || && ! - ~ ? : ().

Numeric types are calculated as 64-bit floating-point numbers. Using comparison operations such as equal to or greater than may return errors.

Supported operators

Category	Operator names	Operators	Example value
Basic operators	Addition operator	+	$1.key1+$1.key2>10
		Subtraction operator	-	$1.key1-$1.key2>100
		Multiplication operator	*	$1.LatencyMs\*1000>10
		Division operator	/	$1.Distance/1000>10
		Modulus operator	%	$1.Column%10==0
Comparison operator	Equal to	==	$1.Number==100 $1.Result=="Error"
		Greater than	>	$1.Number>100
		Less than	<	$1.Number<100
		Greater than or equal to	>=	$1.Number>=100
		Less than or equal to	<=	$1.Number<=100
		Not equal to	!=	$1.Result != "error"
Parentheses	Round brackets Control calculation precedence	()	($1.key1+$1.key2)/$1.key3>100
Logical operators	and	&&	$1.Number>100 && $1.Result=="Error"
Logical operators		or	\|\|	$1.Number>100\|\|$1.Result=="Error"
Escape operation	Escape operation	[]	[$1.process-time], where process-time is treated as a single key.

Last updated: 2026.03.31 11:32:38