diff --git a/cid-redirects.json b/cid-redirects.json index 87c52a2851..3112868c1f 100644 --- a/cid-redirects.json +++ b/cid-redirects.json @@ -1565,6 +1565,7 @@ "/cid/1001": "/docs/send-data/installed-collectors/sources/remote-file-source", "/cid/10011": "/docs/manage/data-archiving", "/cid/1002": "/docs/send-data/installed-collectors/sources/syslog-source", + "/cid/10019": "/docs/alerts/monitors/create-monitor", "/cid/10020": "/docs/alerts/monitors", "/cid/10021": "/docs/alerts/monitors/alert-response-faq", "/cid/10022": "/docs/alerts/monitors/muting-schedules", diff --git a/docs/alerts/monitors/create-monitor.md b/docs/alerts/monitors/create-monitor.md index e8d5d7130f..39757d5abd 100644 --- a/docs/alerts/monitors/create-monitor.md +++ b/docs/alerts/monitors/create-monitor.md @@ -166,13 +166,18 @@ You can set a logs monitor trigger to alert based on the following: Triggers are evaluated by balancing the requirement of timely alert notifications while ensuring that monitor data is indeed available to evaluate trigger conditions. -* For [static logs monitors](#static-detection-method), triggers are similar to "Alert when the result is greater than _ within Y Minutes". The triggers are evaluated periodically as below. - | When detection window (Y) is | Evaluate trigger every | - |:-----------------------------|:-----------------------| - | 15m or less | 1m | - | 15m to 1h | 2m | - | 1h to 6h | 10m | - | Greater than 6h | 20m | +* For [static logs monitors](#static-detection-method), you can control trigger monitor evaluation frequency using the options below. If `Alert when result is than <_> within . Evaluate trigger every .`: + | When detection window (X) is | Evaluate trigger every (Y) | + |:-----|:----------------------| + | 5m | 1m, 2m | + | 10m | 1m, 2m, 5m | + | 15m | 1m, 2m, 5m, 10m | + | 30m | 2m, 5m, 10m, 20m | + | 1h | 2m, 5m, 10m, 20m | + | 3h | 10m, 20m, 40m, 1h | + | 6h | 10m, 20m, 40m, 1h | + | 12h | 20m, 40m, 1h | + | 24h | 20m, 40m, 1h | * For [anomaly logs monitors](#anomaly-detection-method), triggers are evaluated every `timeslice` as specified in the monitor query. For example, the below query is evaluated every 2 minutes. ``` _sourceCategory=Labs/Apache/Access @@ -187,7 +192,7 @@ Triggers are evaluated by balancing the requirement of timely alert notification When configuring monitor trigger conditions, you can set a resolution window to resolve alerts quickly once the underlying issue is fixed. The resolution window specifies how long a monitor will wait before resolving an alert after the issue is corrected. -For example, if your monitor evaluates the last 1 hour, you can set a resolution window of 15 minutes. Once the resolution window is continuously satisfied for 15 minutes, the alert will resolve automatically.
config-resolution-window +For example, if your monitor evaluates the last 1 hour, you can set a resolution window of 15 minutes. Once the resolution window is continuously satisfied for 15 minutes, the alert will resolve automatically.
config-resolution-window #### Static detection method @@ -195,13 +200,18 @@ For example, if your monitor evaluates the last 1 hour, you can set a resolution logs trigger type.png -`Alert when result is within