Skip to main content
PATCH
Change an alert

Authorizations

Authorization
string
header
required

A workspace API key, created in Superlog under Settings → API keys.

Path Parameters

alertId
string<uuid>
required

Alert ID.

Body

application/json
aggregation
enum<string>

count counts matching logs or spans; other aggregations read field. Metrics use sum or avg.

Available options:
count,
count_distinct,
sum,
avg,
min,
max,
p50,
p90,
p95,
p99
comparator
enum<string>

gt fires when the value is above threshold, lt when it is below.

Available options:
gt,
lt
field
string | null

What a log or span aggregation other than count reads: duration, an attribute key, or an AI usage field such as ai:cost.

Maximum string length: 200
filter
object

Narrows the data the alert reads. resourceAttrs keys may start with resource., span., log., or field.; a bare key is a resource attribute. service, severity, spanName, statusCode, and minDurationMs match those fields of a log or span.

groupBy
string | null

The attribute key to split by when groupMode is per_group, such as service.name.

Maximum string length: 200
groupMode
enum<string>

single checks one total. per_group checks each groupBy value and fires for each one separately.

Available options:
single,
per_group
metricName
string | null

The metric to read when source is metric.

Maximum string length: 200
source
enum<string>

logs, traces (spans), or metric.

Available options:
logs,
traces,
metric
threshold
number
windowMinutes
integer

How many minutes of data each check reads.

Required range: 1 <= x <= 1440
enabled
boolean

A disabled alert is not checked.

evaluationIntervalSeconds
integer

How often the alert is checked.

Required range: 60 <= x <= 3600
name
string
Required string length: 1 - 200
slack
object | null

Where firing and recovery messages are posted. Without a channel the alert only records its activations.

Response

OK

alert
object
required