Threshold monitors

Fire when a number crosses a line you set.

The default and the one to reach for first. You know what bad looks like, so say so.

The query behind a threshold monitor

read top to bottom

1['api-gateway-prod']
2| where service == "checkout"
3| summarize requests = count(), errors = countif(status >= 500) by bin(_time, 5m)
4| where requests > 100
5| extend error_rate = round(100.0 * errors / requests, 2)
6| project _time, error_rate

cURL

curl -X POST https://api.logstreem.com/v1/monitors \
  -H "Authorization: Bearer $LOGSTREEM_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Checkout error rate > 2% — runbook/checkout",
    "type": "threshold",
    "apl": "…the query above…",
    "operator": "above",
    "threshold": 2,
    "interval_minutes": 5,
    "range_minutes": 5,
    "notify_on_no_data": true,
    "notifiers": ["ntf_1d7e4b3a09c2f856d4a1"]
  }'

Operators

Operator	Fires when
`above`	value > threshold
`above_or_equal`	value ≥ threshold
`below`	value < threshold
`below_or_equal`	value ≤ threshold

below catches the silence

below on a request count is how you notice a service stopped receiving traffic. It is the monitor most teams only add after the first outage nobody was paged for.

PreviousMonitors NextAnomaly monitors