This section describes how to configure an alarm that is triggered based on the number of appearances of a keyword in Cloud Log Service.

If you want an alarm to be triggered only when a log keyword appears a specified number of times within a certain time range, you can refer to this case to set the query analysis statement and alarm monitoring rule.

Setting a Query Statement

Select the query time range as one hour (relative), and then execute the following statement to count the number of times the keyword ERROR appears in an hour. For specific operations, see Query and Analysis.

ERROR

Viewing Query Results

According to the following query results, the keyword ERROR appeared 11 times in the last hour.

Alarm Monitoring Rule Configuration

Create an alarm monitoring rule based on the above query and analysis results. For specific operations, see Creating an Alarm Rule. Important configuration items are described as follows: Set the trigger condition to Pieces of Data > 5. If the keyword ERROR appears more than five times in logs within an hour, an alarm is triggered.
Set the description in the annotation to "{{fire_result_count}} ERROR errors occurring within 1 hour", and the alarm notification will display the number of times the keyword ERROR appears in logs within the last hour.

Alarm Notification

After creating the above alarm monitoring rules, you can receive an alarm notification as long as the keyword ERROR appears more than five times in the log within the last hour. You can also view the alarm details to trace the source.

Cloud Log Service

Alarm–Alarms Triggered by Keyword Appearances