string

Identifier. Required if the policy exists. The resource name for this policy. The format is:

projects/[PROJECT_ID_OR_NUMBER]/alertPolicies/[ALERT_POLICY_ID]

[ALERT_POLICY_ID] is assigned by Cloud Monitoring when the policy is created. When calling thealertPolicies.create method, do not include thename field in the alerting policy passed as part of the request.

string

A short name or phrase used to identify the policy in dashboards, notifications, and incidents. To avoid confusion, don't use the same display name for multiple policies in the same project. The name is limited to 512 Unicode characters.

The convention for the displayName of a PrometheusQueryLanguageCondition is "{rule group name}/{alert name}", where the {rule group name} and {alert name} should be taken from the corresponding Prometheus configuration file. This convention is not enforced. In any case the displayName is not a unique key of the AlertPolicy.

object (Documentation)

Documentation that is included with notifications and incidents related to this policy. Best practice is for the documentation to include information to help responders understand, mitigate, escalate, and correct the underlying problems detected by the alerting policy. Notification channels that have limited capacity might not show this documentation.

map (key: string, value: string)

User-supplied key/value data to be used for organizing and identifying theAlertPolicy objects.

The field can contain up to 64 entries. Each key and value is limited to 63 Unicode characters or 128 bytes, whichever is smaller. Labels and values can contain only lowercase letters, numerals, underscores, and dashes. Keys must begin with a letter.

Note that Prometheus {alert name} is avalid Prometheus label names, whereas Prometheus {rule group} is an unrestricted UTF-8 string. This means that they cannot be stored as-is in user labels, because they may contain characters that are not allowed in user-label values.

object (Condition)

A list of conditions for the policy. The conditions are combined by AND or OR according to thecombiner field. If the combined conditions evaluate to true, then an incident is created. A policy can have from one to six conditions. IfconditionTimeSeriesQueryLanguage is present, it must be the onlycondition. IfconditionMonitoringQueryLanguage is present, it must be the onlycondition.

enum (ConditionCombinerType)

How to combine the results of multiple conditions to determine if an incident should be opened. IfconditionTimeSeriesQueryLanguage is present, this must beCOMBINE_UNSPECIFIED.

boolean

Whether or not the policy is enabled. On write, the default interpretation if unset is that the policy is enabled. On read, clients should not make any assumption about the state if it has not been populated. The field should always be populated on List and Get operations, unless a field projection has been specified that strips it out.

object (Status)

Read-only description of how the alerting policy is invalid. This field is only set when the alerting policy is invalid. An invalid alerting policy will not generate incidents.

string

Identifies the notification channels to which notifications should be sent when incidents are opened or closed or when new violations occur on an already opened incident. Each element of this array corresponds to thename field in each of theNotificationChannel objects that are returned from thenotificationChannels.list method. The format of the entries in this field is:

projects/[PROJECT_ID_OR_NUMBER]/notificationChannels/[CHANNEL_ID]

object (MutationRecord)

A read-only record of the creation of the alerting policy. If provided in a call to create or update, this field will be ignored.

object (MutationRecord)

A read-only record of the most recent change to the alerting policy. If provided in a call to create or update, this field will be ignored.

object (AlertStrategy)

Control over how this alerting policy's notification channels are notified.

enum (Severity)

Optional. The severity of an alerting policy indicates how important incidents generated by that policy are. The severity level will be displayed on the Incident detail page and in notifications.

string

The body of the documentation, interpreted according tomimeType. The content may not exceed 8,192 Unicode characters and may not exceed more than 10,240 bytes when encoded in UTF-8 format, whichever is smaller. This text can betemplatized by using variables.

string

The format of thecontent field. Presently, only the value"text/markdown" is supported. SeeMarkdown for more information.

string

Optional. The subject line of the notification. The subject line may not exceed 10,240 bytes. In notifications generated by this policy, the contents of the subject line after variable expansion will be truncated to 255 bytes or shorter at the latest UTF-8 character boundary. The 255-byte limit is recommended bythis thread. It is both the limit imposed by some third-party ticketing products and it is common to define textual fields in databases as VARCHAR(255).

The contents of the subject line can betemplatized by using variables. If this field is missing or empty, a default subject line will be generated.

object (Link)

Optional. Links to content such as playbooks, repositories, and other resources. This field can contain up to 3 entries.

string

A short display name for the link. The display name must not be empty or exceed 63 characters. Example: "playbook".

string

The url of a webpage. A url can be templatized by using variables in the path or the query parameters. The total length of a URL should not exceed 2083 characters before and after variable expansion. Example: "https://my_domain.com/playbook?name=${resource.name}"

string

Required if the condition exists. The unique resource name for this condition. Its format is:

projects/[PROJECT_ID_OR_NUMBER]/alertPolicies/[POLICY_ID]/conditions/[CONDITION_ID]

[CONDITION_ID] is assigned by Cloud Monitoring when the condition is created as part of a new or updated alerting policy.

When calling thealertPolicies.create method, do not include thename field in the conditions of the requested alerting policy. Cloud Monitoring creates the condition identifiers and includes them in the new policy.

When calling thealertPolicies.update method to update a policy, including a conditionname causes the existing condition to be updated. Conditions without names are added to the updated policy. Existing conditions are deleted if they are not updated.

Best practice is to preserve[CONDITION_ID] if you make only small changes, such as those to condition thresholds, durations, or trigger values. Otherwise, treat the change as a new condition and let the existing condition be deleted.

string

A short name or phrase used to identify the condition in dashboards, notifications, and incidents. To avoid confusion, don't use the same display name for multiple conditions in the same policy.

object (MetricThreshold)

A condition that compares a time series against a threshold.

object (MetricAbsence)

A condition that checks that a time series continues to receive new data points.

object (LogMatch)

A condition that checks for log messages matching given constraints. If set, no other conditions can be present.

object (MonitoringQueryLanguageCondition)

A condition that uses the Monitoring Query Language to define alerts.

object (PrometheusQueryLanguageCondition)

A condition that uses the Prometheus query language to define alerts.

object (SqlCondition)

A condition that periodically evaluates a SQL query result.

string

Required. Afilter that identifies which time series should be compared with the threshold.

The filter is similar to the one that is specified in thetimeSeries.list request (that call is useful to verify the time series that will be retrieved / processed). The filter must specify the metric type and the resource type. Optionally, it can specify resource labels and metric labels. This field must not exceed 2048 Unicode characters in length.

object (Aggregation)

Specifies the alignment of data points in individual time series as well as how to combine the retrieved time series together (such as when aggregating multiple streams on each resource to a single stream for each resource or when aggregating streams across all members of a group of resources). Multiple aggregations are applied in the order specified.

This field is similar to the one in thetimeSeries.list request. It is advisable to use thetimeSeries.list method when debugging this field.

string

Afilter that identifies a time series that should be used as the denominator of a ratio that will be compared with the threshold. If adenominatorFilter is specified, the time series specified by thefilter field will be used as the numerator.

The filter must specify the metric type and optionally may contain restrictions on resource type, resource labels, and metric labels. This field may not exceed 2048 Unicode characters in length.

object (Aggregation)

Specifies the alignment of data points in individual time series selected bydenominatorFilter as well as how to combine the retrieved time series together (such as when aggregating multiple streams on each resource to a single stream for each resource or when aggregating streams across all members of a group of resources).

When computing ratios, theaggregations anddenominatorAggregations fields must use the same alignment period and produce time series that have the same periodicity and labels.

object (ForecastOptions)

When this field is present, theMetricThreshold condition forecasts whether the time series is predicted to violate the threshold within theforecastHorizon. When this field is not set, theMetricThreshold tests the current value of the timeseries against the threshold.

enum (ComparisonType)

The comparison to apply between the time series (indicated byfilter andaggregation) and the threshold (indicated bythresholdValue). The comparison is applied on each time series, with the time series on the left-hand side and the threshold on the right-hand side.

OnlyCOMPARISON_LT andCOMPARISON_GT are supported currently.

number

A value against which to compare the time series.

string (Duration format)

Required. The amount of time that a time series must violate the threshold to be considered failing. Currently, only values that are a multiple of a minute--e.g., 0, 60, 120, or 300 seconds--are supported. If an invalid value is given, an error will be returned. When choosing a duration, it is useful to keep in mind the frequency of the underlying time series data (which may also be affected by any alignments specified in theaggregations field); a good duration is long enough so that a single outlier does not generate spurious alerts, but short enough that unhealthy states are detected and alerted on quickly.

object (Trigger)

The number/percent of time series for which the comparison must hold in order for the condition to trigger. If unspecified, then the condition will trigger if the comparison is true for any of the time series that have been identified byfilter andaggregations, or by the ratio, ifdenominatorFilter anddenominatorAggregations are specified.

enum (EvaluationMissingData)

A condition control that determines how metric-threshold conditions are evaluated when data stops arriving. To use this control, the value of theduration field must be greater than or equal to 60 seconds.

string (Duration format)

ThealignmentPeriod specifies a time interval, in seconds, that is used to divide the data in all thetime series into consistent blocks of time. This will be done before the per-series aligner can be applied to the data.

The value must be at least 60 seconds. If a per-series aligner other thanALIGN_NONE is specified, this field is required or an error is returned. If no per-series aligner is specified, or the alignerALIGN_NONE is specified, then this field is ignored.

The maximum value of thealignmentPeriod is 104 weeks (2 years) for charts, and 90,000 seconds (25 hours) for alerting policies.

enum (Aligner)

AnAligner describes how to bring the data points in a single time series into temporal alignment. Except forALIGN_NONE, all alignments cause all the data points in analignmentPeriod to be mathematically grouped together, resulting in a single data point for eachalignmentPeriod with end timestamp at the end of the period.

Not all alignment operations may be applied to all time series. The valid choices depend on themetricKind andvalueType of the original time series. Alignment can change themetricKind or thevalueType of the time series.

Time series data must be aligned in order to perform cross-time series reduction. IfcrossSeriesReducer is specified, thenperSeriesAligner must be specified and not equal toALIGN_NONE andalignmentPeriod must be specified; otherwise, an error is returned.

enum (Reducer)

The reduction operation to be used to combine time series into a single time series, where the value of each data point in the resulting series is a function of all the already aligned values in the input time series.

Not all reducer operations can be applied to all time series. The valid choices depend on themetricKind and thevalueType of the original time series. Reduction can yield a time series with a differentmetricKind orvalueType than the input time series.

Time series data must first be aligned (seeperSeriesAligner) in order to perform cross-time series reduction. IfcrossSeriesReducer is specified, thenperSeriesAligner must be specified, and must not beALIGN_NONE. AnalignmentPeriod must also be specified; otherwise, an error is returned.

string

The set of fields to preserve whencrossSeriesReducer is specified. ThegroupByFields determine how the time series are partitioned into subsets prior to applying the aggregation operation. Each subset contains time series that have the same value for each of the grouping fields. Each individual time series is a member of exactly one subset. ThecrossSeriesReducer is applied to each subset of time series. It is not possible to reduce across different resource types, so this field implicitly containsresource.type. Fields not specified ingroupByFields are aggregated away. IfgroupByFields is not specified and all the time series have the same resource type, then the time series are aggregated into a single output time series. IfcrossSeriesReducer is not defined, this field is ignored.

Align and convert toDELTA. The output isdelta = y1 - y0.

This alignment is valid forCUMULATIVE andDELTA metrics. If the selected alignment period results in periods with no data, then the aligned value for such a period is created by interpolation. ThevalueType of the aligned result is the same as thevalueType of the input.

Align and convert to a rate. The result is computed asrate = (y1 - y0)/(t1 - t0), or "delta over time". Think of this aligner as providing the slope of the line that passes through the value at the start and at the end of thealignmentPeriod.

This aligner is valid forCUMULATIVE andDELTA metrics with numeric values. If the selected alignment period results in periods with no data, then the aligned value for such a period is created by interpolation. The output is aGAUGE metric withvalueTypeDOUBLE.

If, by "rate", you mean "percentage change", see theALIGN_PERCENT_CHANGE aligner instead.

Align and convert to a percentage change. This aligner is valid forGAUGE andDELTA metrics with numeric values. This alignment returns((current - previous)/previous) * 100, where the value ofprevious is determined based on thealignmentPeriod.

If the values ofcurrent andprevious are both 0, then the returned value is 0. If onlyprevious is 0, the returned value is infinity.

A 10-minute moving mean is computed at each point of the alignment period prior to the above calculation to smooth the metric and prevent false positives from very short-lived spikes. The moving mean is only applicable for data whose values are>= 0. Any values< 0 are treated as a missing datapoint, and are ignored. WhileDELTA metrics are accepted by this alignment, special care should be taken that the values for the metric will always be positive. The output is aGAUGE metric withvalueTypeDOUBLE.

string (Duration format)

Required. The length of time into the future to forecast whether a time series will violate the threshold. If the predicted value is found to violate the threshold, and the violation is observed in all forecasts made for the configuredduration, then the time series is considered to be failing. The forecast horizon can range from 1 hour to 60 hours.

integer

The absolute number of time series that must fail the predicate for the condition to be triggered.

number

The percentage of time series that must fail the predicate for the condition to be triggered.

string

Required. Afilter that identifies which time series should be compared with the threshold.

The filter is similar to the one that is specified in thetimeSeries.list request (that call is useful to verify the time series that will be retrieved / processed). The filter must specify the metric type and the resource type. Optionally, it can specify resource labels and metric labels. This field must not exceed 2048 Unicode characters in length.

object (Aggregation)

Specifies the alignment of data points in individual time series as well as how to combine the retrieved time series together (such as when aggregating multiple streams on each resource to a single stream for each resource or when aggregating streams across all members of a group of resources). Multiple aggregations are applied in the order specified.

This field is similar to the one in thetimeSeries.list request. It is advisable to use thetimeSeries.list method when debugging this field.

string (Duration format)

Required. The amount of time that a time series must fail to report new data to be considered failing. The minimum value of this field is 120 seconds. Larger values that are a multiple of a minute--for example, 240 or 300 seconds--are supported. If an invalid value is given, an error will be returned.

object (Trigger)

The number/percent of time series for which the comparison must hold in order for the condition to trigger. If unspecified, then the condition will trigger if the comparison is true for any of the time series that have been identified byfilter andaggregations.

string

Required. A logs-based filter. SeeAdvanced Logs Queries for how this filter should be constructed.

map (key: string, value: string)

Optional. A map from a label key to an extractor expression, which is used to extract the value for this label key. Each entry in this map is a specification for how data should be extracted from log entries that matchfilter. Each combination of extracted values is treated as a separate rule for the purposes of triggering notifications. Label keys and corresponding values can be used in notifications generated by this condition.

Please seethe documentation on logs-based metricvalueExtractors for syntax and examples.

string

Monitoring Query Language query that outputs a boolean stream.

string (Duration format)

Optional. The amount of time that a time series must violate the threshold to be considered failing. Currently, only values that are a multiple of a minute--e.g., 0, 60, 120, or 300 seconds--are supported. If an invalid value is given, an error will be returned. When choosing a duration, it is useful to keep in mind the frequency of the underlying time series data (which may also be affected by any alignments specified in theaggregations field); a good duration is long enough so that a single outlier does not generate spurious alerts, but short enough that unhealthy states are detected and alerted on quickly. The default value is zero.

object (Trigger)

The number/percent of time series for which the comparison must hold in order for the condition to trigger. If unspecified, then the condition will trigger if the comparison is true for any of the time series that have been identified byfilter andaggregations, or by the ratio, ifdenominatorFilter anddenominatorAggregations are specified.

enum (EvaluationMissingData)

A condition control that determines how metric-threshold conditions are evaluated when data stops arriving.

string

Required. The PromQL expression to evaluate. Every evaluation cycle this expression is evaluated at the current time, and all resultant time series become pending/firing alerts. This field must not be empty.

string (Duration format)

Optional. Alerts are considered firing once their PromQL expression was evaluated to be "true" for this long. Alerts whose PromQL expression was not evaluated to be "true" for long enough are considered pending. Must be a non-negative duration or missing. This field is optional. Its default value is zero.

string (Duration format)

Optional. How often this rule should be evaluated. Must be a positive multiple of 30 seconds or missing. This field is optional. Its default value is 30 seconds. If this PrometheusQueryLanguageCondition was generated from a Prometheus alerting rule, then this value should be taken from the enclosing rule group.

map (key: string, value: string)

Optional. Labels to add to or overwrite in the PromQL query result. Label namesmust be valid. Label values can betemplatized by using variables. The only available variable names are the names of the labels in the PromQL result, including "__name__" and "value". "labels" may be empty.

string

Optional. The rule group name of this alert in the corresponding Prometheus configuration file.

Some external tools may require this field to be populated correctly in order to refer to the original Prometheus configuration file. The rule group name and the alert name are necessary to update the relevant AlertPolicies in case the definition of the rule group changes in the future.

This field is optional. If this field is not empty, then it must contain a valid UTF-8 string. This field may not exceed 2048 Unicode characters in length.

string

Optional. The alerting rule name of this alert in the corresponding Prometheus configuration file.

Some external tools may require this field to be populated correctly in order to refer to the original Prometheus configuration file. The rule group name and the alert name are necessary to update the relevant AlertPolicies in case the definition of the rule group changes in the future.

This field is optional. If this field is not empty, then it must be avalid Prometheus label name. This field may not exceed 2048 Unicode characters in length.

boolean

Optional. Whether to disable metric existence validation for this condition.

This allows alerting policies to be defined on metrics that do not yet exist, improving advanced customer workflows such as configuring alerting policies using Terraform.

Users with themonitoring.alertPolicyViewer role are able to see the name of the non-existent metric in the alerting policy condition.

string

Required. The Log Analytics SQL query to run, as a string. The query must conform to the required shape. Specifically, the query must not try to filter the input by time. A filter will automatically be applied to filter the input so that the query receives all rows received since the last time the query was run.

For example, the following query extracts all log entries containing an HTTP request:

SELECT  timestamp, logName, severity, httpRequest, resource, labelsFROM  my-project.global._Default._AllLogsWHERE  httpRequest IS NOT NULL

object (Minutes)

Schedule the query to execute every so many minutes.

object (Hourly)

Schedule the query to execute every so many hours.

object (Daily)

Schedule the query to execute every so many days.

object (RowCountTest)

Test the row count against a threshold.

object (BooleanTest)

Test the boolean value in the indicated column.

integer

Required. Number of minutes between runs. The interval must be greater than or equal to 5 minutes and less than or equal to 1440 minutes.

integer

Required. The number of hours between runs. Must be greater than or equal to 1 hour and less than or equal to 48 hours.

integer

Optional. The number of minutes after the hour (in UTC) to run the query. Must be greater than or equal to 0 minutes and less than or equal to 59 minutes. If left unspecified, then an arbitrary offset is used.

integer

Required. The number of days between runs. Must be greater than or equal to 1 day and less than or equal to 31 days.

object (TimeOfDay)

Optional. The time of day (in UTC) at which the query should run. If left unspecified, the server picks an arbitrary time of day and runs the query at the same time each day.

integer

Hours of a day in 24 hour format. Must be greater than or equal to 0 and typically must be less than or equal to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

integer

Minutes of an hour. Must be greater than or equal to 0 and less than or equal to 59.

integer

Seconds of a minute. Must be greater than or equal to 0 and typically must be less than or equal to 59. An API may allow the value 60 if it allows leap-seconds.

integer

Fractions of seconds, in nanoseconds. Must be greater than or equal to 0 and less than or equal to 999,999,999.

enum (ComparisonType)

Required. The comparison to apply between the number of rows returned by the query and the threshold.

string (int64 format)

Required. The value against which to compare the row count.

string

Required. The name of the column containing the boolean value. If the value in a row is NULL, that row is ignored.

object (NotificationRateLimit)

Required for log-based alerting policies, i.e. policies with aLogMatch condition.

This limit is not implemented for alerting policies that do not have a LogMatch condition.

enum (NotificationPrompt)

For log-based alert policies, the notification prompts is always [OPENED]. For non log-based alert policies, the notification prompts can be [OPENED] or [OPENED, CLOSED].

string (Duration format)

If an alerting policy that was active has no data for this long, any open incidents will close

object (NotificationChannelStrategy)

Control how notifications will be sent out, on a per-channel basis.

string (Duration format)

Not more than one notification perperiod.

string

The full REST resource name for the notification channels that these settings apply to. Each of these correspond to the name field in one of the NotificationChannel objects referenced in the notificationChannels field of this AlertPolicy. The format is:

projects/[PROJECT_ID_OR_NUMBER]/notificationChannels/[CHANNEL_ID]

string (Duration format)

The frequency at which to send reminder notifications for open incidents.